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FOREWORD 


The Explosive Safety Executive Lecture Series was 
designed to give top management a better understanding of 
their responsibilities for safety. Each lecture of the 
series covers a significant major problem area in 
explosive safety. The lecture content is intended to be 
of sufficient technical depth to be meaningful, while at 
the same time providing a broad coverage of the subject. 
The group of six lectures is designed to provide a 
general survey of explosive safety problems as related to 
launch area operations. 

This report is a compilation of the course notes, lecture 
transcripts, and subjects discussed on the floor. The 
results are presented as a comprehensive reference to 
afford the manager a familiarity with space vehicle 
ordnance and explosive safety problems. 

It is hoped that those in attendance at the Executive 
Lecture Series gained a greater appreciation for the KSC 
Safety Program - and their safety responsibilities as 
managers . 
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Lecture Number One 
"TOP MANAGEMENT RESPONS I S ! L IT I ES" 
Part I 

Dr. G. J. Bryan 
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1.0 INTRODUCTION 


Historically, fatal accidents are relatively rare, but to witnesses their 
seriousness is vividly clear. Most near-misses are not documented. 

The complexity of modern spaceships in launch configuration is far greater than 
that of early missiles. Ordnance and propellant subsystems and devices are 
present for propulsion, control, separation, destruct, and actuation purposes 
throughout these spaceships. The number of systems on Saturn approaches 100. 
High-energy RF fields, stray currents, electrostatic fields, and flammable 
vapors are often present. 

The capability for destructive accidents is enormous. There is no excuse for 
not utilizing the safety knowledge we have gained. Much of this knowledge has 
been gleaned from the reports of accidents, some of which were fatal. 

Is ordnance safety different from ordinary safety? Is it any more serious to 

kill. a person by an ordnance accident than to have a truck driver employee be 

/ 

killed in a highway accident? 

The answer to both of these questions is "YES." The immediate following 
question is "WHY?" There are three major differences involved: 


Employee's Dependence Upon Employer 


First, the truck driver has largely in his own brain, due to his past 
training and experience, the knowledge to avoid an accident. The indi 
vidual working with ordnance is largely dependent on the procedures 

1 ? — i 4- ~ i_ : — j. l _ — c - m-. . ~ r x. i — : *. ^ p ; i : ^ : — . ,i_ r _ u i_ - ? 


i ? — i j. ~ 

Jpp I I CU LVJ 


^ „ r ^ 4 .. . 

LtIC 301 ciy wi 


.Ml IC. I I L. 


i r- K 


using, and the training and indoctrination provided him. For this reason, 
the blame may well rest at some higher level in the organization. 


Publ ic Atti tude 


The second reason is that, due to the lack of a general understanding of 
ordnance safety problems, there is an immediate reaction to a death due 
to ordnance causes. This reaction is, "Was it just luck that kept this 
accident from killing many people rather than one?" In other words, past 
experience has shown that occasionally explosives and/or propellants have 
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caused massive destruction of lives and property. The tendency is, 
therefore, to equate one death to the possible risk of many lives asso- 
ciated in the minds of the general public with any ordnance accident. 

(see Table 1 , page 1-22) 

• Unrecognized Factors 

The third reason that an ordnance accident is different is that experts 
in ordnance safety are continuously aware that there is danger due to 
unrecognized factors. Any ordnance accident requires detailed examination 
to determine the cause so that it can be added to the body of accumulated 
experience in preventing future accidents. 

There is often new information available, and we cannot afford to miss 
this information. The statement has been made that ordnance manuals have 
been written in blood. This statement is all too true. 

The reason that I have gone over differences between ordnance safety and 
ordinary safety is that it is unfair, and, in some cases, a serious shock 
for an individual at a middle to very high management position to suddenly 
realize that he is suspect for responsibility of an ordnance accident. It 
is even more of a shock if an inquiry shows that he is responsible. There 
have been cases of mental breakdown under such circumstances. 

An issue of the Armed Services Explosive Safety Board Publication related 
the case of a person who actually committed suicide when told of an accident. 
This man took his life because he thought he could have prevented the acci- 
dent, had he been present. 

2.0 BASIC RULES 


There are two basic guidelines to a realistic ordnance safety program. First, 
no hazardous operations are to be performed. Second, any deviation from this 
rule must be approved by top management. Approval will normally not be given 
without overriding reasons, such as a national emergency or the fact that the 
risk taken in performing a dangerous operation is less than that involved by not 
performing the operation. Now with hazardous operations, I wish to mention here 
that I'm not including potentially hazardous operations. We have potentially 
hazardous operations at all times at KSC, but if we treat these operations 
correctly, they are not hazardous. 

3.0 WHAT IS A HAZARDOUS OPERATION? 

One question commonly asked is: "What is the dividing line between a hazardous 

and non-hazardous operation?" In other words, what constitutes a risk? This 
is clearly a gray area. As a rough guide, the fol laving comments may be useful. 
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An ordnance operation should involve considerably less probability of injury 
than a normal job (such as machine shop work). Why is this? The reasons go 
back to some of the earlier comments. There are still unknown areas. One 
should assume that probabilities are somewhat worse than one calculates. 

Second, with ordnance, the hazard sometimes has a chain effect which can 
greatly enlarge the injury to people and the damage to property. The hazard 
involved in an ordnance operation should not even approach the hazard the 
individual takes in the use of local highways. 

4.0 MANAGEMENT APPROACH 

4. 1 Determination of Responsibilities 

The head of any organization will always have safety responsibilities. One of 
his first tasks is to have those responsibilities clearly defined, both as to 
extent and limitations. It is also important that his responsibilities be 
accompanied by authority. Where there is any doubt concerning this, it must 
also be clarified and correctly established. 

4. 2 Discharging of Responsibilities 

Once the responsibilities and authority are established, the head of an organi- 
zation must see that the responsibilities are discharged. This may be done by 
one or more of the following methods: 

• He personally discharges them (normally possible only in small organizations) 

• He delegates considerable responsibility to qualified subordinates. 

• He contracts and provides for other organizations to assume these respons- 
ib i 1 i t ies . 

• He gets written agreement with some Government organization to assume the 
responsib i 1 i ty. 

In the latter two cases, residual monitoring responsibility must be performed to 
assure that the contracted or Government organization is dutifully and success- 
fully performing its contract or agreement. 

4. 3 Organ i zat ion 

One of the functions of management is to establish an organization that can 
satisfactorily perform its safety responsibilities at all levels. A large 
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organization's safety responsibilities will generally be shared between the 
line organization and a separate Safety Division. In a correctly oriented 
company, this parallel responsibility will create little friction because it 
arises from a need for efficiency and effectiveness. 

There will generally be some people in the line or nonsafety staff organization 
who will have a significant portion of their time designated toward safety func- 
tions. This arises from two demands: the scarcity of highly qualified people 

in specialized fields of safety, and the need for some concentration of safety 
responsibility within line organizations. In a safety conscious organization 
the line organization will be asking for more help than the Safety Division can 
give, and the Safety Division will be eagerly requesting aid from specialists 
assigned to other divisions. 

4‘. 4 Leadersh ? p 

The head of an organization must provide leadership in the field of safety. He 
must set an example for others to follow in attitude, action, and policy state- 
ments. This will directly affect his immediate subordinates and be reflected 
throughout the organization. He will set an example when he is present during 
an operation by following safety regulations and showing an active interest in 
safety aspects of the operation. 

This same leadership function must be performed down the line through each 
supervisory level. 

4. 5 Monitoring and Probing 

All levels of management have the responsibility of periodically probing and 
monitoring the safety requirements which they have placed on their subordinates. 
It is not enough to place the requirements and then say, "I have done my part." 
Any organization requires careful probing and testing to assure it is alive 
and healthy. 

The head of an organization may make occasional inspections at the operating 
level. He will then look closely for any evidence of safety slackness. He will 
talk briefly with employees performing the work. He will find out if they know 
what their safety responsibilities are, if they understand the safety regula- 
tions which they are to follow, and if they show an interest in safety. Any 



weakness which he may find tells him that somewhere between top management and 
the working level of his organization, there is a safety weakness. 

He will then take action to determine where that weakness is and to correct it. 
There are several approaches to this. Basically, they are standard management 
techniques which could apply to any problem so they will not be detailed here. 
Normally, training, indoctrination, or clarification of responsibilities will 
fix a weakness. Sometimes a transfer to a less critical position may be needed. 
Occasionally an employee may have to be fired. 

5.0 PERFORMANCE OF DUTIES 

A little thought will reveal the need for a safety organization with many 
safety respons ib : 1 i t ies parallel to those of a line organization. This is due 
to a need for reducing the safety load on the line organization (which already 
has many varied responsibilities) without reducing the effectiveness of the 
safety condition of that organization. One of the critical functions of a 
separate Safety Division is to assure that a pipeline from the worker to the 
top management is ever present and functioning. 

5. 1 Training and Indoctrination 

Training and i ndoctr i nat ion are important at all levels of an organization. Each 
superior must feel that it is up to him to insure that his subordinates are edu- 
cated and supervised on safety. 

In a certain sense, safety responsibility cannot be delegated. In a practical 
sense, there muse be some delegation. In safety matters, as in other matters, 
it is important that one be careful in the choice of individuals to whom perfor- 
mance of safety responsibility is delegated. If a person is chosen who is not 
competent in the ordnance and propellant field, it must be clearly outlined to 
him that he must personally obtain the necessary training, or acquire (permanently 
or on loan) an individual who is competent to perform the necessary functions. 

If no one is present in an organization to do the required job, then an individual 
must be trained, hired, or brought in on a consultant basis. 

All levels of an organization which are concerned with ordnance and propellant 
work must have some specialized training in ordnance and propellant safety. Super 
visory personnel need such knowledge in order to select individuals to whom author 
i ty is to be delegated, to assess the magnitude of the safety problem in their 
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area of operation, and to take adequate steps to maintain safety in their area 
of responsibility. Normally, there will be a basic safety course given to all 
employees. This will usually be arranged by the Safety Division in coordination 
with the Training Division and line organization. There will also normally be 
more specialized training courses given to those who directly handle ordnance or 
must work in close proximity to it. It is necessary to give occasional refresher 
courses as well as briefings on new changes of equipment' or operations. 

Indoctrination is always important at all levels. Of course, once the importance 
of safety is recognized, half the battle is won. An individual who is safety 
conscious will find out what his safety responsibilities are, he will request 
adequate training, he will look for problems, he will report problems, and he 
will solve problems. Indoctrination is important at each level from top manage- 
ment on down. Each supervisor must feel that it i s up to him to insure that 
his men are educated and supervised in safety. He must simultaneously promote 
safety by persuasion and by force of authority. 

5.2 Safety Planrinq 

Safety planning involves a number of functions and is critical for efficient and 
effective operation. One of these is the early isolation of operations which 
require particular attention in order to be safe. Another of these is early 
recognition and Cetermi nat ion of special facility and equipment requirements for 
safe operations. The advance recognition of a need for an increase in trained 
personnel , or of new procedures is important if schedules are to be safely met. 

A related, but somewhat different, problem is the participation in R and D 
phases so that safety is adequately considered in design of equipment, facilities 
and spaceships. 

5 . 3 Procedures . 

The line organization will normally be responsible for preparation of overall 
procedures. As soon as they begin performing this function, they will immediately 
need Standard Operating Procedures for handling certain standardized safety situ- 
ations. Ordinarily, they will eagerly accept those prepared by the Safety Divi- 
sion. Normally, the Safety Division will prepare an official handbook containing 
all Standard Operating Procedures and practices. This will be regularly updated. 
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The line organization is responsible to see that safety is adequately covered 
in all their procedures. Due to their many other responsibilities, the line 
organization personnel will inevitably lean heavily on the Safety Division (plus 
any specifically designated individuals in their operating section) to assure 
themselves that safety is adequately covered. 

There are many dangers which may be visible to only a few specialists or a few 
individuals performing certain operations. In a "safety responsive" organi- 
zation, such problems will be brought out into the open and discussed. This 
will normally result in the requirement that all procedures be reviewed by the 
Safety Division and by specifically designated specialists. 

Good procedures are the cornerstone of safe operations with propellants and 
explosives. If well indoctrinated and trained employees are also equipped with 
high-quality procedures, the basic requirements for safe operations have been 
met. Safe equipment and facilities are also a requisite; however, good pro- 
cedures can, in many cases, overcome recognized deficiencies in equipment and 
facilities. All operations must be performed by a procedure; all procedures 
must be reviewed by competent individuals; all changes to procedures must be 
reviewed by comoetent individuals. No exceptions to procedures should otherwise 
be permitted. This, of course, means procedures must be workable and they must 
be adequate. 

The individual doing the work, in most cases, is not best qualified to write 
procedures for performing the operation. Neither is he the best for judging 
the safety of design. In- most cases, a high-level supervisory or staff-level 
individual performs the final detailed review. Normally, this review will 
not be spread among many individuals, because very few people are competent to 
make such a review. 

If no one is present to write the procedures, then an individual must be 
trained, hired, or brought in on a consultant basis. Unfortunately, there is 
no simple training course that will assure competence; however, the following 
general approach should give an individual the knowledge to draft procedures: 

• Pertinent documents and manuals should be read. 

• There should be a brief residence time at a facility which has similar 
safety problems. 
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• Specialists in related areas should be consulted. 

With such preliminary training, an individual without previous specialized 
training, but with related knowledge, may be in a position to recognize many 
safety problems and to draw up rough procedures. When reviewing rough pro- 
cedures, an individual recently trained in ordnance safety should ask the 
advice of experienced individuals working in related fields. 

Once these procedures are developed, there is no substitute for the trained 
individual observing the procedure in detail during its first use, preferably 
on inert ordnance. Some revisions will normally result. This same walk- 
through is also a good time to have consultant assistance. Once safe ordnance 
procedures have been developed, it follows automatically that they should not 
be carelessly changed for format or similar purposes. In many cases, sequence 
is critical. 


It is the responsibility of the supervisor in charge of an operation to check 
that procedure: are being followed and that any unexpected problem is not 
treated with a makeshift procedure. If the individual performing the job devi- 
ates knowingly from a procedure, without permission of his supervisor, he will 
generally be considered personally responsible. This is so, provided he has 
been carefully indoctrinated in the importance of rigorously following procedures 
and provided the procedure was reasonable to follow. 


If an accident results from a mistake in a procedure, those reviewing the pro- 
cedure may bea/ responsibility. This will not be true if it is an unrecognized 
problem which an expert in the field would not have foreseen. Unfortunately, 
hindsight is often much clearer than foresight. This statement alone shows the 
importance of careful development and review of all ordnance procedures. If an 


! nrl ! \m 1 i.ir i f ! nn +* r\ r 

...... u ........ VV I I (. ) MW| I I W jrf I 


V I V* VJ u I 


^ures is not cj'Jsli’ffcd to do this Job, his s u p 0 r *■ 


visor may be held responsible. This responsibility may reflect completely up 
the line unless each individual from the top to the bottom has been made clearly 
aware that no hazardous operations are to be performed. Only top management can 
make exceptions, and only qualified people will, therefore, review procedures. 
This might be considered, thus, as a third rule, although it is a result of 
application of the first two. 
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Accidents may result during an operation that is not recognized as an ordnance 
operation. It is thus clear that any operation performed around or near a motor, 
igniter, detonator, squib, or explosive charge or related device be examined for 
possible ordnance implications by a qualified individual or individuals. Pro- 
cedures which are not at first thought hazardous may in actuality be quite 
dangerous. A thorough review may reveal that they have to be reclassified or 
changed to make them non-haza rdous. This, of course, should occur before they 
are performed the first time, not in retrospect. The same sequence of respons- 
ibilities holds here as it does for a clearly definable ordnance operation. 

5 • k Monitoring o f Operations to Detect Safety Problems and to Determine tha t 

Safety Procedures are being Adequately Performed 

• 

There will always be a need for repeated surveillance of operations to detect 
unrecognized safety problems and to determine that safety portions of procedures 
are being adequately performed. This, again, is a joint responsibility between 
line and safety organizations. It is normally desirable to make dry runs of any 
new procedures. In these cases, safety monitoring is particularly important. 

In certain opera:ions, safety factors require a member of the Safety Division 
in constant attendance to ascertain that all safety precautions have been met. 

5 • 5 Technical Liaison with Internal and External Organizations on Safety Matters 

Close and early technical liaison on safety matters between all external ane 
internal organizations involved is important. Geographic and distance barr'ers 
should not be allowed to stifle such interchange. 

It is necessary that the line organization and Safety Division be in close com- 
munication. In large organizations this generally involves certain individuals 
in the Safety Division being constantly employed as mutual contacts. These 
individuals may sometimes be assigned to specific areas or buildings. 

5*6 A Source of Assistance and a Depository of Information on Safety Matters 

The Safety Division and certain specialists in the line department wi 1 1 normally 
perform this duty, which is self-explanatory in nature. 
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5.7 Facilities and Equipment 


The design of new facilities, new equipment, and tools should receive the same 
careful safety review as do new operations. Designers should remove the human 
factor from hazards by making protection as permanent and as automatic as 
possible. 

Adequate maintenance from a safety viewpoint is also a requisite. This is a 
joint Safety Division and a line organization responsibility. 

5.8 Reporting Accidents 

The facts associated with any accidental fire, deflagration, or explosion must 
be reported completely and accurately so that others doing similar work may be 
warned, and so that the best corrective action may be taken to prevent similar 
acc i dents. 

Minor incidents, which in themselves do little or no harm, frequently give warn- 
ings of unsuspec:ed hazards. These incidents should be widely reported and 
their significance given thorough consideration. 

It is the duty of the line organization to see that all the facts are provided 
to the Safety Division. Normally, the Safety Division will also investigate as 
well as record sjch accidents and spread the results throughout the organization 
to other areas which may be affected. The Safety Division and line organization 
will normally share responsibility for developing preventive measures. 

5 . 9 I nd i v i dua 1 s 

Each employee must be indoctrinated to think of safety constantly, as this is 
the only way in which injury-free performance can be realized. It is impossible 
to bring about a fool-proof physical environment and set of rules; a setting in 
which no injury can happen. Personal safety depends on sincere safety- 
mindedness and good judgment on the part of each individual; not at occasional 
intervals, but continuously as an integral part of daily activity. 

Safety-consciousness of most new technical employees needs to be developed. It 
is commonplace to find many shades of fatalism, exemplified in such pat expres- 
sions as "accidents are bound to happen." These are simply rationalizations for 
indifference or bravado. Most injuries are caused by specific carelessness or 
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poor judgment on the part of someone. Each individual worker must be the major 
factor in his own safety and that of his neighbor. Every individual i,n the 
organization has safety responsibilities; these may vary greatly in magnitude. 
If every individual understands his responsibilities and discharges them in an 
effective and efficient manner, a safe organization will result. 

6.0 ACCIDENT RESPONSIBILITY REACTION 


ACCIDENT REACTION 


Figure 1-1 

The above figure shows how an accident can reflect throughout an entire 
organization. You are not safe anywhere in the organization. There are many 
other responsibility connections besides those shown; anyone in an organization 
may become involved. For any who have not been in on the reporting and investi 
gation of accidents, I can assure you that it is very serious, consumes a great 
amount of time, and there is an enormous amount of paper work involved. 














7.0 CONCLUSION 


Top management has heavy responsibilities in the field of Ordnance and Propel- 
lant Safety. These cannot be dodged. One cannot trust "luck." Their discharge 
is largely by the application of standard management techniques, but even manage- , 
ment needs some specialized technical information. The remaining lectures are 
designed to give this technical information. 

Inadequate safety can lead to horrible loss of life, enormous rebuilding costs 
and costs due to delay of programs, and even possible cancellation of projects. 

One accident can greatly exceed the cost of a good safety program. 

Ordnance and Propellant Safety must be an integral part of engineering operations. 
Top management is responsible for seeing that everyone understands and discharges 
his responsibilities. 
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Lecture Number One 
"TOP MANAGEMENT RESPONSIBILITIES" 
Part II 

Mr. L. T. Dombras 



1.0 INTRODUCTION 

KSC is one of the most publicized areas in the world, and one which probably 
will be involved with the greatest aggregate of potential hazards conceived 
by modern man. In considering the accident rate at KSC, it is a tribute to 
the KSC Accident Prevention Program to know that one is safer at work than at 
home . 

Management must be concerned with safety. This concern is not based on self- 
survival or humane considerations alone. Rather, it is because management 
realizes that accidents interfere with program schedules and are extremely 
expensive in dollars, equipment, and in some cases, the loss of skilled person- 
nel. This may seem to be a very cold and dispassionate viewpoint; however, it 
is a position which substantiates the funding for safety engineering. 

2.0 MISSION 70 

Recently the President of the United States appealed to Federal Agencies to 
reduce the carnage and disabilities which have cost our space program consider- 
able time and expenditures. As a result, a program was initiated entitled 
"Mission 70". The purpose and the objective of "Mission 70" is to reduce the 
injury frequency rates of all Federal Agencies to at least 70% of the 1963 
figures by 1970. 

During 1963, the injury frequency rate for KSC was 2.78 disabling injuries for 
every million manhours worked. Your "Mission 70" target is to reduce this 
figure to 1.95 injuries per million manhours. This is quite a target for your 
organization because increasingly more hazardous operations will occur with 
the larger and more complicated space programs forecasted for KSC. 

During President Johnson's speech concerning "Mission 70," the following 
statistics were presented: 
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OCCUPATIONAL ACCIDENT STATISTICS 



FEDERAL 

NATIONAL 


1958-1964 

ANNUAL RATE 

DEATHS 

1 ,200 

13,800 

DISABLING INJURIES 

300,000 

1 ,960,000 

LOST MAN-DAYS 

18,500,000 

235 , 000 , 000 + 


Figure 1-2 


3.0 INDUSTRIAL ACCIDENT PROGRAMS 

In 1963, the cost to all Government Agencies as a result of injuries was 
36.6 million dollars. From 1958 to date, the total cost of accidental injuries 
is estimated to be in excess of l£ billion dollars. Staggering as these sta- 
tistics are, it. ! s a fact, based upon the accomplishments in every major branch 
of industry, that practically every one of these accidents could have been pre- 
vented by dynamic safety organizations enjoying complete support and the backing 
of top management . 

• Since 1926, National Safety Council data shows that occupational accidents 
in all industries were reduced to values approaching zero. 

• The expenditures required to insure a good safety program are extremely 
small as compared with the cost of accidents. Imagine how much of the 
l£ billion dollars, mentioned above, could have been saved if safety 
offices were provided with more trained personnel and safety educational 
programs . 

• Some degree of hazard is associated with every operation. A perfect 
safety program, that is one with no accidents, can oniy be achieved by 
giving meticulous attention to every form of activity that is carried 
on . 

• Injury prevention does not require special theories or highly technical 
skill but depends to a great degree on "safety mindedness ." This 
"safety mindedness" may be defined as a constant active attention to 
safety in every detail, every day, on the part of every individual 
involved in every manner. 
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e Any management, regardless of the size of the business or type of 

industry, can eliminate almost all injuries. Safety is your business, 
and it is one of your management responsibilities. Your obligation 
to your employees is that their safety should not be sacrificed or 
jeopardized in any way. 

• Most injuries result from faulty equipment or hazardous operat'ons. If 
you correct either of these causes, you may prevent injuries. Faulty 
behavior can be covered by training and creating the "safety mindedness" 
among your workers. However, minimum injury rates can only be achieved 

by reducing the physical hazards associated with your area of jurisdiction. 

• Off-the-job accidents should be reduced. The gains scored by industry in 
this particular area have been significant. Promotional activities 
directed toward lessening off-the-job accidents have proven very worth- 
while. 

3. 1 Industry and the KSC Safety Program 

How does the KSC Safety Program compare with industry? KSC operations appear 
to combine the work conducted by practically all industries: chemical, manu- 

facturing, electronic, aircraft, construction, and the toy industry. The 
spacecraft and booster programs involve many potentially hazardous operat : ons 
interrelated into a very complex pattern. In industry, the guidelines and 
functions of the safety supervisors are generally clearly defined and the inter- 
faces are capable of orderly analysis. KSC's operations with booster systems 
and space vehicles are continually changing from launch to launch and from 
program to program. 

4.0 KSC SAFETY PROGRAM 

KSC operations are complex and involve many operations which are potentially 
dangerous. The Safety Office is responsible to the Director (KSC) for control 
of the overall safety program performed by NASA or its contractor personnel. 
Specially trained representatives implement all safety aspects of operational 
and launch activities, industrial activities, explosives, accident prevention, 
traffic safety, etc. 

The KSC Accident Prevention Program is basically executed by the Safety Office. 
Basic responsibilities and final authority on all matters of safety during 
operations performed by NASA and its contractors are assumed by the KSC Safety 
Office. The task assigned to your Safety Office is enormous -- the respons- 
ibilities are terrifying and the personal rewards are negligible. When things 
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go right, the Safety Office is doing its job; but if accidents occur, the 
wrath of higher management descends upon the Safety Office. To a great degree, 
pure luck and chance play a big factor in the Accident Prevention Program. 

4. 1 KSC Safety Office 

The function of a Safety Office is to develop safety standards, safety criteria 
for launch operations, and to provide engineering services in industrial explo- 
sives and operational safety. In addition, safety personnel conduct surveys and 
evaluate accidents and conduct safety training and promotional activities. The 
work assignments cover many many areas over a relatively large geographical 
area. In a recent study conducted by STL, we found that the Safety Office is 
not adequately staffed with a sufficient number of personnel to cover all areas 
of hazardous operations anticipated during 1965. Recent Government policies, 
resulting in a freeze on the number of personnel which KSC may acquire, may 
necessitate acquiring additional help through the contractors, and certainly 
the help of managers. 

5.0 MANAGERS' RESPONSIBILITY 

Top management's responsibility is to approve, sanction, and support the Safety 
Office. Without this support, the safety organization will disintegrate and 
become ineffective. Accident prevention is a good, sound business policy. As 
managers, you must also assist in safety promotion, educational activities, 
and training programs. 

Every supervisor has personnel working directly for him who are involved in 
some form of physical activity. Since some degree of hazard is associated 
with every form of activity, the highest degree of injury prevention can only 
be achieved by insuring the safety of every operation in each assigned area 
of supervision. These areas may not appear hazardous, but remember, accidents 
do not require explosives, propellants or dangerous materials. And accidents 
don't just happen — they are caused. How can management prevent accidents? 
Simply by creating a safety awareness among the entire work force. The large 
number of personnel working at Cape Kennedy cannot be monitored at all times 
by a small force of Safety Office personnel. All personnel must help to 
eliminate the causes of accidents. 
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As managers, you must back up your Safety Office in all operations and respect 
their responsibilities. Your efforts will be rewarded if you practice the 
fol lowing rules: 

0 Back ud the Safety Office in all operations. 

• Provide approval, sanction, and support. 

0 Aid in safety promotion. 

0 Create safety awareness. 

0 Assume safety responsibility as part of management. 

6.0 NASA'S SAFETY RESPONSIBILITIES 

The responsibilities of NASA Headauarters as outlined in the Management Manual, 
Chapters 2 and 23, are the overal 1 directior of the NASA Safety Program. The 
NASA Safety Office at Headquarters is responsible for the overall direction of 
the NASA Safety Program. The instructions outlined in the Management Manual 
apply to NASA Headquarters and all its field installations. These instructions 
are relatively broad in treatment and general in nature, thereby allowing each 
field installation to develop its own safety program to meet the specific needs 
for problems which arise at each location. 

In studying the NASA program, STL found that there is a very logical plan and 
Safety Accident Prevention Program. This plan is very adequately described by 
a story told by Or. John Furbay, a noted lecturer. Dr. Furbay describes a bug 
which was born in the world's most expensive and beautiful persian rug. 



Figure 1-3. THE RUG BUG 
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This bug in the rug spent his entire life scampering around between the fibers 
eating crumbs and finally, after a very full life, it died. That bug lived 
in that rug all of its life, yet it died never realizing that it had lived in 
a pattern, a magnificent design. You cannot live like the bug in the rug. 

You must learn the pattern and your particular responsibilities in that pattern 

The overall design of the NASA Safety and Accident Prevention Program starts 
right at the top at NASA Headquarters in Washington. It is outlined in NASA 
Management Manual, Chapter 23, Instruction 23-1 — 1 A . 

The responsibilities of Headquarters are: 

• Overall direction of NASA Safety Program. 

• Development of basic policies and standards. 

• Evaluation of program effectiveness. 

7.0 POLICIES - NASA SAFETY ACCIDENT PREVENTION PROGRAM 

The NASA Safety Office is responsible for the overall direction of the NASA 
Safety Program. Headquarters is responsible for the development of basic 
policies and standards with regard to the Safety Program at each field instal- 
latipn, and Is also responsible for evaluating these programs with regard to 
effectiveness in order to reduce the number of accidents and injuries among 
Government Officers and employees. Final authority at the top management level 
is assigned to the Associate Deputy Admi n i strator of Administration. Policies 
and the NASA Safety Accident Prevention Program are outlined in the NASA 
Management Manual. Instructions apply to all field installations including KSC 
Instructions in the NASA Management Manual outline the following basic policies 
for the NASA Safety Accident Prevention Program: 

• Ensure safety of NASA and contractor employees. 

• Avoid delay of NASA programs due to accidents. 

• Prevent damage to property and equipment. 

• Assure proper protection of the public. 

• Provide risk and loss factor data. 
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The preceding policies are to insure the safety of NASA and contractor employees 
during their work on NASA programs. In addition to these policies, NASA Head- 
quarters also requires safety rules and guides for the prevention of injuries, 
accidents, and destruction to property. Uniform safety standards are broad in 
scope and place limits upon the following: 

• Design and construction of equipment, facilities, and buildings. 

• Procedures for the performance of hazardous operations, 
e Standards for industrial hygiene. 

• Standards for safety and related requirements in contractual clauses. 

• Accident and injury investigation reporting. 

8.0 KSC SAFETY RESPONSIBILITIES 

The John F. Kennedy Space Center safety responsibilities are to develop a Safety 
Accident Prevention Program in accordance with NASA instructions. These respons- 
ib i 1 i t ies are : 

• Develop a safety and accident prevention program. 

• Provide leadership in accident prevention. 

• Accident investigation and reporting. 

® Ensure safety of all operations and facilities at KSC. 

These instructions require that you provide continuous leadership in the prevention 
of injuries to personnel and damage to equipment and facilities. You must have 
the capability of reporting, investigating, and following-up action on accidents 
involving all persons on or near NASA installations, and you are to insure the 
safety of all operations and facilities used by NASA installations or its contrac- 
tors working at these installations. When facilities at one installation are being 
utilized by one or more contractors or one or more NASA organizations, the resident 
director shall be responsible for the safety of all operations and facilities in 
such cases. These responsibilities and the guidelines by which they are carried 
out are being executed by the KSC Safety Office. They require your help if an 
accident-free program is to be achieved. 
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9.0 KSC SAFETY PROGRAM INTERFACES 


The nature of the work at KSC requires numerous groups, agencies, and contractors 
working closely together under potentially hazardous conditions. 

9. 1 Contractor - KSC 

Since KSC is responsible for the safety of all operations at the Space Center, 
the work performed by contractors must be monitored and the contractor's safety 
responsibility must be defined. 

9.2 NASA Tenant Organizations 

Practically every operation planned for KSC will involve several NASA organi- 
zations. Each one is responsible for specific portions of the launch program 
and each agency is responsible to its personnel for safety. However, KSC and 
the Director are responsible for the overall operations with regard to safety. 

It is important that tenant NASA organizations understand their responsibilities 
and that every effort be made to insure adequate coverage of all aspects of 
launch programs. 

9.3 Internal KSC Groups 

You, as managers, in dealing with the contractors, must interface with the 
KSC Safety Office and insure adequate protection of all NASA and contractor 
personnel working in your jurisdiction. 

During some operations, several NASA organizations will be working concurrently 
on the space vehicle or booster system. In these instances the guidelines 
should be clear and well defined. 

S.h AFETR - KSC 

Joint responsibilities exist between DOD - NASA; these interfaces are defined in 
the DOD/NASA (Webb-McNama ra ) Agreement, dated 17 January 1963, anc * subsequent 
jointly sponsored amendments. 
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SUPERVISORS' SAFETY CHECK LIST 


Here are some items which you should consider during your normal 
work day and which should help reduce accidents to you and personnel 
working for you: 

1. Accept safety as part of your job. 

2. Recognize the relationship of good safety and good 
management . 

3. Give good safety instructions to new employees. 

k. .Make known to all that you will deal harshly with 
chroni c vio lators . 

5. Provide safety equipment. 

6. Form and assist safety meetings. 

7. Investigate every accident and every incident. 

8. Provide proper training. 
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TABLE 1 


SOME DISASTERS INVOLVING PROPELLANTS AND/OR EXPLOSIVES 
(EXCLUDING MINE EXPLOSIONS) 


1917, December 6 - Halifax, Nova Scotia, Canada. 

Explosion of war materials and fire; over 1,500 killed; 
4,000 injured; 20,000 homeless; property loss $35,000,000. 

1921, September 21 - Oppau, Germany. 

Explosion of ammonium nitrate kills about 600 persons. 

1937, March 18 - New London, Texas. 

Natural gas explosion destroys schoolhouse; 413 children 
and 14 teachers killed. 


1939, March 1 - Osaka, Japan. 

Huge munitions dump explodes, wiping out village; 500 
killed and injured: 300 houses destroyed: 8,313 homeless. 

1939, July 10 - Penandara de Bracamonte, Spain. 
Approximately 100 killed; 1 500 injured; town demolished 
in explosion of munitions factory. 

1941, June 8 - Smederevo, Yugoslavia. 

Ammunition plant explodes; killing 1,000 and demolishing 
most of town. 


1942, May 1 - Tessenderlo, Belgium. 

Explosion in chemical works kills 250 workers, injures 1,000. 
1944, April 14 - Bombay, India. 

128 die in ship fire which causes explosion in ammunition 
dump; 1,000 injured. 

1944, July 17 - Port Chicago, California. 

Explosions at two ammunition dumps kill more than 300* 


1947, April 16 - Texas City, Texas 
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more than 500 dead or missing. 


1947, August 20 - Cadiz, Spain. 

Three hundred to 500 killed in explosion of shipyards. 

1948, March 9 - Tsingtao, China. 

Explosion of ammunition storehouse kills at least 200; 
several hundred injured. 
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TABLE I (cont'd) 


1948, July 28 - Ludwigshafen, Germany. 

Explosions and fire wreck chemical works of I. G. Farben Company; 
some 200 killed and several thousand injured; damage $ 15 , 000 , 000 . 

1948, September 22 - Hong Kong, China. 

Fire and chemical explosion in warehouse; 135 killed, 57 injured. 
1953, October 16 - Boston, Massachusetts. 

Explosion and fire aboard U. S. aircraft carrier LEYTE kills 37, 
injures 40. 

1956, August 7 “ Cali, Columbia. 

Seven trucks carrying dynamite explode; dead estimated at 1,100. 

1958, June 23 - Santa Amaro, Brazil. 

Fireworks explosion causes about 100 deaths. 

1980, March 4 - Havana, Cuba. 

French munition ship blows up, killing 75 " 100 and injuring 200. 


Reference: Encyclopedia Americana 
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Lecture Number Two 

"EXPLOSIVES AND PROPELLANTS IN ACTION" 

Part I 

Mr. J. Larks 

1.0 THEORY OF DEFLAGRATION AND DETONATION 

Before any discussion of explosives can be undertaken, the meanings of at 
least three words must be clearly understood: explosion, deflagration, and 

detonat i on . 

1 . 1 Explosion 
Explode - (eks‘plod') 

General: To cause to burst noisily. 

Explicit: The sudden release of pressure in which a shock wave is 

created. 

An explosion is a result, not a cause or a chemical reaction in itself. The 
pressure which causes an explosion may be built up gradually or rapidly. If 
the pressure is built up gradually, it must be in a confined volume to cause 
an explosion. The explosion of a steam boiler is a good example of pressure 
buildup in a confined volume; the explosion occurs when the container 
ruptures. 

Many highly reactive chemicals can cause an explosion. The burning of powde * 
in an artillery round is an example of rapid buildup of pressure in a confined 
volume. When the firing pin detonates the primer of a shell, the reactive 
material (powder) in the case liberates hot gases. As the gases expand, they 
force the projectile through the barrel of the gun. When the projectile leaves 
the barrel, the pressure is released suddenly and an explosion occurs. Note 
that the explosion is NOT the reaction, but the release of pressure. 

Extremely reactive chemicals can cause an explosion in unconfined areas. In 
this case, the chemicals build up pressure faster than it can be dissipated 
to the surrounding atmosphere; the atmosphere, rather than a solid object or 
container, acts as the confining agent. Explosions, therefore, are dependent 
upon reaction rate and a size effect or scale. 
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1 . 2 Def laqrat ion 
Deflagrate - (dSf ^1 a • grift) 

General: To cause to burn away with sudden evolution of flame and 

rapid, sharp combustion. 

Explicit: A chemical reaction producing vigorous evolution of heat 
and sparks or flame and moving through the material at 
a speed less than that of sound. 

Deflagration is an exothermic reaction, that is, heat is liberated during the 
process. The exothermic reaction may be decomposition, oxidation, or combustion 
and the most familiar example of deflagration or flame is commonly termed 
burning. Deflagration can cause an explosion if the process is confined and 
causes a rapid pressure buildup. In the determination of deflagration, the 
important factor is the reaction rate. To visualize and define the mechanism 
of deflagration, the flame is defined as standing still with the fuel or 
unreacted material flowing into the flame and the products or reacted mater- 
ial flowing away from it. The rate at which the unreacted material or fuel 
flows into the flame is termed the burning velocity. Many mixtures and fuel 
materials have characteristic burning velocities which are dependent on 
temperature and pressure. Burning velocities of gases range from a few 
centimeters per second to about one meter per second. 

When certain mater ial s, termed explosives, are subjected to rapid increases in 
temperature, a temperature level is attained where volatilization from the 
surface, prior to the reaction of the material itself, creates heat resulting 
in a self-sustaining reaction. This temperature level is termed the "ignition 
temperature" of the material; it is at this point that deflagration begins. 
Deflagration can be termed a diffusion phenomenon, (similar to the spreading of 
an odor in still air). 

Explosives may be divided into two classes; low explosives and high explo- 
sives. Pyrotechnic mixtures and loose black powder are termed low explosives 
and will undergo violent deflagration when sufficient heat is generated. 
Nitrocellulose materials ordinarily undergo rapid deflagration but, if 
confined, this can become detonation. Lead azide, termed a high explosive, 
will not deflagrate but will detonate even at one atmosphere pressure. TNT 
(trinitrotoluene) will deflagrate when loosely confined; however, if its con- 
finement is such that high pressures are developed, this initial deflagration 
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will be followed by detonation. Nitroglycerin, also termed a high explosive, 
will deflagrate at ordinary pressures in small quantities; however, the defla- 
gration will produce a large amount of the heat and, detonation ensues if 
larger quantities are present. In large quantities, even ammonium nitrate 
(a very insensitive material) can be caused to detonate if confinement is such 
that high pressures can be developed during deflagration. An example of rapid 
deflagration is burning of a solid propellant retro rocket. The star-shaped 
core affords a large initial surface area which increases the mass burning 
rate (m). 




Figure 2-1 . RETRO ROCKET 

Thrust is kept approximately constant by maintaining an essentially constant 
surface area presented to the flame front from ignition through to depletion. 

1.3 Detonat ion 

Detonate - (d£t ha t ) 

General: To product a loud noise by the sudden liberation of gas 

in connection with chemical decomposition or combination; 
to explode with sudden loud report. 

Expl ic i t: A chemical reaction producing vigorous evolution of heat 
and sparks or flame and moving through the material deto- 
nated at a speed greater than that of sound. 
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A detonation can be differentiated from a deflagration by comparison of the 
manner in which the products flow and the rate, or speed, of the reaction. 
Detonation can be considered a wave phenomenon similar to the propagation of 
sound while deflagration is a diffusion phenomenon. In a detonation, the 
products or reactive materials flow toward the area of the reaction; in a 
deflagration this is opposite, that is, they flow away from the reaction. 

The speed of propagation of the reaction is faster in a detonation than the 
characteristic speed of sound in the material; the detonation being carried 
forward on the crest of the shock wave. A deflagration, with sufficient con- 
finement and buildup, can become a detonation; however, the inverse cannot 
occur. Due to the formation of the shock wave and the sudden release of 
pressure, a detonation is always associated with an explosion; however, an 
explosion is not always due to a detonation. 

To visualize the mechanism of detonation, the shock wave is frozen in time and 
considered to be standing still. A slice of the material containing the wave 
front of the shock wave is considered. Matter under exact conditions of pres- 
sure, specific volume, specific energy, and a particular velocity stream into 
this slice; however, the matter emerges from the slice under different con- 
ditions of pressure, velocity, specific volume and specific energy. 

The hydrodynamic theory of detonation is the result of much research and its 
theoretical application. This theory is based on the known characteristics 
of shock waves and uses the chemical theory of absolute reaction rates. 

The three laws of conservation of mass, energy, and momentum are used to 
establish three equations relating to the five variables; pressure, density, 
temperature, detonation rate, and transitional rate of the gaseous molecules 
of the reaction products. 
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EQUATIONS OF MOTION 

FOR A 


ONE DIMENSIONAL CASE 


MOMENTUM p Q 

n 
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dx 
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t = time 

p Q = initial dens i ty 
u = particle velocity 
P = pressure 
E = energy 


Q = heat added per unit mass 
V = specific volume 
X = distance 
x = LaGrange coordinate 


ftX(x,t) 

ax 


P 0 v(x,t) 


Figure 2-2 

These lav/s express the following facts: 

• Conservation of Hass 

The mass flow rates into and out of the slice are equal. 

• Conservation of Energy 

The difference between the total energy, internal and kinetic, into 
and out of the slice, is equal to the net worth work performed by the 
gas . 

• Conservation of Momentum 

The rate of momentum change in the slice is equai to the difference i 
pressure . 

EQUATION OF STATE 
pv = nRT + a (v)p 

where: p = pressure R = gas constant 

v = volume T = temperature 

n = constant a (v) = average covolume 


Figure 2-3 
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The equation of state is derived using the values shown in Figure 2-3 and 
a fifth equation is obtained by applying a physical principle. This prin- 
ciple states that a shock wave passes through a gas with a velocity equal to 
the sum of the translational velocity of the gas, plus the velocity of sound 
in the gas at its final temperature and density. By solution of the five simul- 
taneous equations, the characteristics of a given explosion can be calculated. 



Figure 2-4 

VARIATION OF OVERPRESSURE 
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What are shock waves and how do they occur? Figure 2-4 depicts an idealized 
shock wave created by a sudden expansion and increase in pressure having taken 
place at the 0 point of the coordinate system. Time is not considered in look- 
ing at an isolated shock wave, but referring to Figure 2-5 it can be seen that 

« 

with increasing time, as shown by numerically increasing subscripts on the t 
parameter, the shock wave essentially retains its basic shape as it moves out 
from the source center but steadily diminishes in peak overpressure values until, 
at some distance from the source--and together with some related time T, the 
wave will have been reduced to a negligible overpressure. 

From the information obtained through the hydrodynamic theory, a mechanism of 
detonation can be visualized. After the detonator functions, a detonation zone, 
in which the chemical reaction is taking place, travels through the column of 
explosive. 


EXPLOSIVE 



REFORE DETONATION 


| DETONATION 


;0ETONATl0N 

:• products: 


CHEMICAL 
REACT ION 
ZONE 


ZONE | 



UNDFTONAT 3 EXPLOSIVE 


PARTIALLY DETONATED 


Figure 2-6 

This detonation zone is generally considered to include a very narrow shock 
zone (10 ^cm) or shock wave. Little or no chemical reaction occurs in this 
shock zone, but the pressure reaches its peak. The detonation zone includes 
not only this shock zone, but also the chemical reaction zone (0. 1-1.0 cm). 
Following this detonation zone are the detonation products. In front of the 
shock zone is the unreacted explosive in its original state of density, pressure, 
velocity, and temperature. At or near the beginning of the chemical reaction 
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zone, the high temperature to which the material is raised by compression in 
the shock zone initiates chemical reaction. Maximum density and pressure occur 
at the beginning of the reaction zone, while the temperature and reaction rate 
reach their peaks at the completion of the chemical reaction. The detonation 
products flow with great velocity, but of lesser degree than the velocity of 
the detonation zone, toward the undetonated explosive. This is characteristic 
of detonation in contra-distinction to deflagration, in which case the reaction 
products flow away from the unreacted material. The velocity of advance of 
the detonation zone is termed the detona-tion rate. 

As each individual molecule of explosive undergoes ordinary thermal reaction, 
starting with a low initial temperature, there is a lag effect or induction 
period that depends exponentially on the reciprocal of the initial absolute 
temperature. With an initial temperature of 725°C, the induction period is 
of the order of 10 ^ second. With high initial temperatures, it appears 
that the last 75 percent of the reaction requires only about 10 '' second. 


EXPLOSIVES 

DETONATION CHARACTERISTICS 



Load i ng 
Dens i ty 
G/ML 

Temperature 

°C. 

Pressure 
10 ATM 

Detonat ion 
Rate 
M/Sec 

N i trogl ycer i n 

1 .60 

5,370 

1 .99 

8,060 

Tetryl 

1.50 

4,480 

1.48 

7,125 

TNT 

1.50 

3,600 

1.10 

6,480 

Ammon ium N i t ra te 

1.00 

1,350 

0.25 

3,420 


Figure 2-7 
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Lecture Number Two 

"EXPLOSIVES AND PROPELLANTS IN ACTION" 
Part II 

Dr. G. J. Bryan 



FT r 
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1.0 INTRODUCTION 

The behavior of propellants and explosives can be explained by a few basic 
ideas. Most of these are relatively simple, as so many important things are. 

In spite of their simplicity, only a few people fully use these basic ideas in 
their thinking and work. 

2.0 DEFINITIONS 

2. 1 Webster's Definitions 

• Burn 

To be on fire; to give forth light and heat - and eleven other meanings. 

• Deflagrate 

To burn with sudden and sparkling combustion; to burn or vaporize suddenly. 

• Expl os i on 

A violent bursting with noise, as in the case of explosives. 

• Detonate 

To explode with sudden violence. 

2.2 Scientific Definitions and Discussion 

• Exothermic Reactions 

An exothermic reaction is one in which heat is released. In a fire, defla- 
gration, or detonat i on, exothermi c chemical reactions are always involved. 

• Burning, Combustion, and Deflagration 

Burning and combustion are equivalent terms used to describe the process 
by which fires and deflagrations progress. These processes are generally 
limited to those in which heat is transferred from the hot zone to the 
reactants by convection, conduction, or radiation. There is no clear 
dividing line between a fire and a deflagration, since the difference is 
purely one of rapidity or violence. 
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• Expl os i ons 


An explosion is a sudden release of pressure. It is a result, not a cause 
in itself. A fire or deflagration may cause an explosion if sufficiently 
confined. A detonation is always an explosion, but not vice versa. 

• Detonations 


In a detonation, the reactants are heated by the adiabatic compression 
resulting from a shock wave. This heated zone then reacts rapidly enough 
to maintain the shock wave. Clearly, the reactants must be premixed. 

Strictly speaking, a detonation may be limited to those processes in which 
a shock wave of steady velocity is maintained. Some reactants may detonate 
at either of two different velocities. It is important to note that shock 
waves are rapidly attenuated in non-reactive media. 

A shock wave is a strong pressure disturbance which is progressing through 
a material at a velocity greater than the velocity of sound in that material. 
The velocity of sound may be described as the velocity at which a weak pres- 
sure disturbance progresses in a material. This velocity is a constant at 
constant temperature of the material, but a shock wave may cover a wide 
range of higher velocities. The ratio of the shock-wave velocity to that of 
sound is called Mach number. 

See Figure 2-7 below for a comparison between detonation and deflagration. 


DEFLAGRATION 

HEAT TRANSFER 


DETONATION 


CONDUCTION 

CONVECTION 

RADIATION 


SHOCK WAVE 

NO INTERNAL 
POSSIBLE EXTERNAL 

Figure 2-8 


• Fuels and Oxidizers 


ADIABATIC COMPRESSION 
BY STRONG SHOCK 


ALWAYS INTERNAL 
ALWAYS EXTERNAL 
(except in vacuum) 


Combustion is often explained as being the chemical combination of a fuel 
(reducing agent) and an oxidizer. 

An oxidizer may be loosely defined as a substance containing an excess of 
oxygen or halogen, with fluorine and chlorine being the most useful halogens. 
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Fuels may be loosely defined as substances containing carbon, hydrogen, 
and light metals. In many cases, this classification is unsatisfactory, 
particularly when both type radicals are contained within one molecule. 

Such borderline cases can generally be squeezed into a related classifi- 
cation of "oxidizer rich" or "oxidizer poor." An oxidizer-rich compound 
will decompose into compounds of which one or more will definitely be an 
oxidizer. An oxidizer-poor compound will decompose into compounds of which 
one or more will definitely be a fuel. 


Specific Impulse (l ) and Exhaust Velocity (c) 

Specific impulse is a measure of propulsive effectiveness of a propellant. 
This is best expressed in units of lb^ - sec/lb m , which has a direct physi- 
cal interpretation. The effective exhaust velocity can be considered as 
the velocity of the exhaust products wh i ch have had an equivalent for~e 
applied to them per unit mass for one second, since one lb^/lb m will impart 
an acceleration of g ft/sec^; !1 



where c is in ft/sec. 


Note that this effective velocity has hidden within it corrections so that 
only the longitudinal component of the velocity vector of a nozzle with a 
given expansion angle is included, and also a correction for any differences 
in exit pressure and external ambient pressure is also included. 


Using these cefinitions, the gain in a rocket's velocity for gravity and 
drag -free space becomes: 


AV = I g In 
sp 


[ initial mass 
|_ final mass _ 


(where the change in mass is due to propellant combustion). I is often 
defined for convenience in computations as a constant, equal to^the l S p 
under vacuum conditions, plus a variable which is a function of the external 
ambient pressure. 

3.0 DAMAGE ASSESSMENT 


*2 I T • - 1 u _ _ _ • 

3 • 1 I U Ld 1 Tldb b 

The mass of a propellant or explosive is a good measure of its maximum hazard 
potential under worst case analysis. This is generally reflected in the design 
of areas where they are handled. Of course, equal masses of explosives and 
propellants are not necessarily of equal maximum hazard potential. Solid pro- 
pellant motors will generally bear a classification of either military Class 2 
or Class 9 or the equivalent Classes B and A (Type 3) for ICC usage. The 
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principal differences between these classes is in the ease of detonation; 
class 2 (or B) ,i s not ' cons i dered detonable in the form present whereas class 9 
(or A (Type 3)) is detonable. 


3 .2 Mass Consumption Rate, Confinement, and Impact 


In most cases, the rate at which a propellant or explosive releases energy is 

the most important factor in determining its damaging potentialities. See below. 

e 


m 


m = dm/dt where: m = mass and t = time 


PROPELLANTS 
S = surface area 
p = density 

r = linear burning rate 



EXPLOSIVES 
p = dens i ty 
U = shock velocity 
S = area of shock wave 


b = coefficient 
p = pressure 
n = exponent 

m = pSr =pSbp R 


m = pSU 


Figure 2-9. MASS BURNING RATE 

A piece of propellant burning in the open would simply be a fire hazard to 
nearby objects. It might, of course, set up a chain of disastrous events. 


If the burning propellant were confined in a rocket, the duration of burning 
would be shorter, the rate of energy release would be higher, the effects 
would be more intense and directional, and the fire hazard would extend for 
a much greater distance in the direction the nozzle was pointing than it would 
on an unconfined burning. The not exhaust products may exit at a velocity 
near 8000 ft/sec. Hot particles of aluminum oxide may be present to increase 
erosion and thermal transfer. 


If the rocket were free to move or its force and/or jet could free it, then 
there would also be a projectile that could do damage to people, spaceship, 
equipment, and/or a facility. (The equation for AV can be used for calculating 
velocities of impact.) Since the intense jet would accompany it, damage and 
injury could easily be quite serious. 
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As soon as the rocket impacted any object, the possibility of destroying the 
rocket would be present. This would undoubtedly lead to a number of small, 
high-velocity fragments of case and burning propellant. This would greatly 
increase the probability of injury and damage over a wide surrounding area. 
Clearly, the damage caused by such a rocket would also be a function of its 
in i t ial s i ze. 

Why is it that a rocket which explodes or is destroyed by impact is nearly 
always more dangerous than a similar mass of unconfined propellant? In the 
act of exploding, and even more so in the action of impact, there is usually 
considerable breakup and shattering of propellant. This may enormously i-crease 
the burning surface of propellant. By the burning rate law, m is proportional 
to surface area (other variables equal). This enormous increase in area may 
well be from 100 to 10,000 times the original area. Even with a shattered 
case, such an enormous area increase may actually release hot gases so rapidly 
that localized se 1 f-conf i nement is realized and m is even further increased by 
localized high pressure zones. Present evidence indicates that this self- 
confinement effect increases the violence of the explosion more rapidly than 
does increasing the mass of a rocket. 

A detonating explosive releases its energy with extreme rapidity. Since a 
detonation shock front may propagate in excess of 8000 meters/sec (26,300 ft/sec), 
a sphere of 2.63 ft. in radius (equivalent to more than four tons of an explo- 
sive) could be consumed in 100 microseconds. 

The pressure developed in a detonation may reach 1.5 million psi and the reflec- 
tion of such a shock wave may exert pressures of 3*0 million psi. Such pressures 
are so terrific that an explosive resting on heavy steel plate may punch out its 
outline through the plate. 

Velocities of particles from confining tubes or nearby objects will generally 
be less than half of the shock wave velocity. Even so, such fragment velocities 
may easily reach 7000 ft/sec. Drag will, of course, rapidly slow down such 
particles. Even so, lethal fragments will persist for quite large distances. 

Even very thin, light fragments can be penetrating at high velocities. 
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One distinguishing characteristic shown by detonating explosives is that even 
small quantities can closely approach the peak pressure developed by large masses. 
Fragments will thus be of similar velocities to those projected from large masses. 
A few grams of encased high explosives can easily kill or seriously injure a 
group of people. 

Confinement of high explosives has three important results: initiation becomes 

easier, there may be a modest increase in detonation velocity, and the confining 
case acts as a source of high velocity fragments. 

Detonation will fail to occur in an unconfined explosive if its dimensions are 
below specific (critical) lower limits. This is normally called a "critical 
diameter." This is of the order of a few centimeters or less for most explosives 
and for propellants which have been shown to be detonable. Some substances, 
ammonium nitrate being noteworthy, appear to require very large masses in order 
to propagate a detonation. Ordinarily, most encasing materials will have an 
effect similar to increasing the dimension of the charge - the higher the 
density and the g.'eater the strength of this material, the greater the effect. 

The sensitivity of a crushed or shattered material is nearly always much higher 
than that of the highly consolidated material. Propellants which cannot be deto- 
nated under violent initiation conditions may be expected to become comparable to 
ordinary explosives in sensitivity when in a finely divided form. 

3*3 Blast Effect s 

When a rocket ignites, there is nearly always an ignition shock wave set-up. The 
surrounding air has not yet been set in motion. When a large burning rocket is 
shattered by impact, there is an enormous increase in the rate of product gas 
generation. A substantial shock wave may thus be set-up. There is always a 
shock v/3 vs du r i n ^ 0 ds tons t i on In sir 0 p.d 2 rs su 1 1 i ncj sir shock • 

Even in a vacuum, the resulting products from a detonation will create an appre- 
ciable pressure on any intervening object. Calculations indicate that a one-pound 
charge of pentolite in a vacuum will produce a peak pressure of between 36 psi 
and 79 psi at a distance of 128 cm. Using cube root scaling laws, a 1000 pound 
charge in a vacuum would produce the same peak pressure at 1280 cm (42 ft). This 
value is roughly of comparable magnitude to the 60 psi to be expected in air for 
a representative explosive. 
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A description of some shockwave characteristics is illustrated in four figures; 
see Figures 2-4, 2-9, 2-10 and 2-11. 

SHOCK FRONT VALUES 


Peak Overpressure 
(psi) 


Peak Dynamic Pressure 

(psi) 


Maximum Wind Velocity 
(mph ) 





- 1 i-2- 



- 1 p 



where ; 

u = 

particle velocity 


U = 

shock ve loci ty 


p = 
0 

initial density 


P = density in compressed zone 
Figure 2-12. PARTICLE VELOCITY EQUATION 


Damage is caused by the resultant effects of overpressure and dynamic pressure. 

The dynamic pressure increases more rapidly than the overpressure, so that there 
is a cross-over in relative magnitude. This dynamic pressure is the same dynamic 
pressure encountered in exterior ballistics. Calculations of the force exerted 
on an object also require a drag coefficient for computation (being one (1.0) 
for a head-on flat plate configuration). 

The human body can sometimes take fairly heavy overpressures without fatality. 

Even in the case o r initial survival, the impact of moving objects or the tossing 
of the .body into an object may result in death. 

A reflected shock wave also is shown in Figure 2-10 above. 

k.O PROPELLANTS 

4. 1 Liquid Propellants 

• Liquid Monopropellants 

Practical liquid monopropellants are presently only a few in number. Hydra- 
zine and hydrogen peroxide are representatives. 

Hydrazine is very insensitive; in fact, it has not been detonated by ordinary 
means. Heating a closed container or the presence of reactive contaminants 
can, of course, cause a pressure explosion. It is also poisonous. 

Note that hydrazine is a strong reducing agent. This is a characteristic 
property of a fuel. Hydrazine can indeed be used as a fuel in a b i -p rope 1 1 ant 
system, although its derivatives have largely displaced it in such systems. 

Hydrogen peroxide is heat sensitive and in higher concentrations., detonable. 
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Many other monopropellants have been considered for use, and additional 
ones may be put to practical use in the future. In the past, monopropellants 
of l^p greater than hydrazine have generally been too sensitive for use. 

Liquid monopropellants are particularly susceptible to the adiabatic com- 
pression of entrained bubbles causing ignition. 

• Liquid Bi -propel 1 ants 

Such systems are of m3ny types. Liquid oxygen (LOX) with kerosene-type hydro- 
carbons, LOX with Hydrogen, LOX wi th Ethyl Alcohol, and Fluorine with Hydrogen 
are representative of clear-cut fuel -oxidi zer systems. High energy fuels, 
such as hydrazine and unsymmetrical d imethy 1 hydrazi ne (UDMH), may be used 
single or as a mixture with oxidizers such as LOX, Fluorine, N_0, , White 
Fuming Nitric Acid (WFNA), or Red Fuming Nitric Acid (RFNA). 

Each ingredient of these must be considered singly for individual chemical 
reactivity and compatibility. With all of these, the greatest danger is 
present during loading and transfer operations and while the boosters are 
loaded. Spillage of any of these can easily cause fires and sometimes explo- 
sions. Some of them are quite poisonous, and some of them are extremely 
reactive with a wide range of materials. Simultaneously, spillage of fuel 
and oxidizer is the most serious type problem. Some of these are hypergolic 
so that there is an automatic fire; others form detonable mixtures. 

4.2 Solid Propel 1 ants 

Certain aspects of solid propellants will be described in other lectures. 


• Double-Base Propellants 

The principal constituents of double-base solid propellants are nitroglycerin 
and nitrocellulose. Modest quantities of a plasticizer, such as diethyl- 
phthalate, and smaller quantities of a stabilizer, such as d iethyl centra 1 1 i te , 
are also present'. The stab i 1 i zer is slowly exhausted with. age. If it becomes 
completely exhausted, particularly with large grains, self-heating and conse- - 
quent explosion may result. The safe-life of any double-base propellant 
should always be ascertained. When there is any doubt, a manufacturer's rep- 
resentative should be contacted. 


maw kc 
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grains can normally, even in small rockets, permit more efficient rocket 
design. In modern rockets, the strictly double-base propellants are little 
used, but composite variations are used instead. 


Double-base propellants are, in general, detonable, but do require strong 
initiation. 


• Composite Propellants 

Composite propellants may conveniently be divided into low energy binder 
systems (normally a type of synthetic rubber such as the older polysulfide 
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or the newer polyurethane or polybutadiene-acrylic acid copolymer) and high 
energy binder systems, such as double-base propellant. These binders are 
heavily loaded with finely ground inorganic salts, such as ammonium perchlor- 
ate and finely divided metals such as aluminum. 

In general, the high energy binder systems are detonable; whereas well- 
consolidated low energy binder systems are not. As previously mentioned, 
crushing, shattering, or shredding may be expected to make most of the low 
energy binder systems detonable. 

\ 

• Pyrotechn i c 

Pyrotechnic is a term generally used in modern days to denote compositions 
• which produce a high percentage of hot solid particles. In rockets, these 
are principally used in the ignition systems, either as the main igniter 
charge or as a booster charge between the squib and main charge. Boron- 
potassium nitrate is a typical pyrotechnic composit on. Rocket propellants 
are increasingly replacing these as the main charge, because of their greater 
reproducibility of action. The increasing use of metals in rocket propellants 
also makes them more suitable for ignition than older compositions. 

It is dangerous to generalize on pyrotechnic compositions. Detailed study 
of the characteristics of individual systems is advised. Friction sensitiv- 
ity, static sensitivity, compatibility, and surveillance require careful 
attention. When used as main charges for igniters, their i r reproduc i b i 1 i ty 
can cause serious ignition peaks with consequent case rupture. 

• Products of Combustion 


After launch, problems occasionally arise, due to the products of propellant 
combustion mixing with air to form pockets of combustible or explosive gases. 
This is particularly true of metallized composite propellants, whose products 
usually contain large quantities of hydrogen and carbon monoxide. (Both are 
combustible and form detonable mixtures with air.) 

The products of combustion may also be toxic: for instance, carbon monoxide, . 

hydrochloric acid, and hydrofluoric acid. 

5.0 EXPLOSIVES 
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Liquid explosives have already been mentioned under the liquid propellant head- 
ings. Liquids are not intentionally used for explosive purposes in rockets at 
the present time. 

5.2 Solid Expl os ? ves 


• Initiating and Priming Explosives 

I n i t iating and priming compounds are explosives which are easily detonated. 
In rockets, initiating and priming explosives are usually initiated 
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electrically; they are also carefully protected from other methods of ini- 
tiation. Lead azide and lead styphnate are representative initiating 
exp 1 os i ves. 

Where detonation is not desired, but rather ignition (priming), initiating 
explosives may be used in conjunction with, or replaced by, pyrotechnic 
compositions (such as a mixture of potassium chlorate and lead thiocyanate). 

Whenever possible, such initiating or priming devices should be protected 
by effective safing and arming devices (SS-A). The S&A device provides 
physical and electrical isolation until late in launch countdown. This is 
probably the most important point in rocket safety. Unfortunately, small 
rockets and other small systems are often not so protected and special 
work-around procedures, such as late installation, must be used. 

® Boosting Explosives 

Explosives of intermediate sensitivity (such as tetryl) which can be initiated 
by an initiating explosive, often are placed between the initiator and the 
main charge. This insures detonation of the main charge. There is an increas 
ing trend toward replacing such booster charges with a low density pressed 
charge of materials such as RDX. This greatly increases the impact sensi- 
tivity of the RDX, but retains the other superior qualities, such as high 
temperature stability. 

• Bursting or forking Charge 

RDX compositions, TNT, PETN, Tetryl and other materials are used for this 
purpose. Some of these materials also may be used as boosting compositions, 
or even as additives in initiating and priming trains. Due to its high 
thermal stability and high brisance, RDX is increasingly being used in 
rocket and launch vehicle operations. 

6.0 CONCLUSION 

Propellants and explosives can cover the full range of uncontrollable fires, 
deflagrations, and detonations when accidentally ignited. When we study them 
in detail, it is amazing that our record of success is as high as it is. 

Clearly, painstaking thoroughness in planning and action is necessary to pre- 
vent accidental ignition. We must design our facilities, equipment, and opera- 
tions so that injury and destruction are minimized in case of accidents. 
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Lecture Number Three 

"Electrical Detonators and Squibs & Their 
Associated Initiation & Ignition Trains" 

Mr. S. H. Rush 



1.0 INTRODUCTION 

Ordnance system safety engineering has changed drastically over the last five 
years. Engineering advances are easily recognized when comparison is made 
between the ordnance systems of early missiles and one of the current space 
vehicles. As ordnance systems have become more sophisticated and additional 
safety hazards have been identified, the methods required to provide ordnance 
safety have become increasingly complicated. 

Throughout this discussion the terms electro-explosive device and initiator will 
be used interchangeably to represent either a squib or a detonator. Strictly 
speaking, the following definitions apply: 

• Initiator - a general term that is used to describe any electro-explosive 
device (EET). 

• Squib - A pyrotechnic device. It is a deflagration device which produces 
a burning phenomenon. A squib is used to ignite propellants which produce 
high temperature gases to perform work. 

• Detonator - Initiates a high exptosive. It is, in itself, a high explosive 
device and produces a detonation which may initiate other high explosives. 

2.0 SAFING DEVICES 

A primary safing device is required on all ordnance systems. The primary safing 
device i s a unit which has, as a minimum requirement, the capability of breaking 
the electrical circuit (firing circuit) to the initiator. Two types of safety 
devices are the arm-disarm switch and the safe and arm device. 
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FIRING LINES ARE SEPARATED FROM ARMING AND MONITOR LINES BY THE USE OF SEPARATE RECEPTACLES 


Figure 3~1 

2.1 The Arm-Pi sarm Device 

An arm-disarm device makes and breaks the electrical circuit to the electrical 
initiators. Figure 3“1 is a general electrical schematic of an arm-disarm 
switch. This device meets minimum requirements as it is capable of breaking ‘ 
the firing circuit. The arm-disarm device can be powered by a motor-operated 
switch, a solenoid-operated switch, a relay, or by any of several other methods 

2.2 The Safe ana' Arm Device (S&A) 

An S&A device must be detonator safe; that is, if the sensitive elements are 
initiated in the "safe" position, the subsequent explosive or pyrotechnic train 
will not be initiated. To do this, a barrier must be placed between the EED 
and the remainder of the explosive or pyrotechnic train. This is done with 
sliders or with rotors v/hich, when the system is armed, turn the rotor or move 
the slider into line with the rest of the explosive train. To conduct the deto 
nator safety test, the EED is initiated in various positions from the full-safe 
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to the full-arm position and the point at which the explosive or pyrotechnic 
train will be set-off is determined. The probability of initiation and the 
detonator safety of the system can be determined from the results of this test. 
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FIRING LINES ARE SEPARATED FROM ARMING AND MONITOR LINES BY THE USE OF SEPARATE RECEPTACLES 


Figure 3“2 

Shown above is a general schematic of an S&A device in the "safe" position. 

This is a redundant device as two initiators are utilized; however, this 
schematic shows only one side of the system. One of the important features is 
the safing pin arrangement. The safing pin holds both the barrier and the 
switches in the "safe" pos i t ion unt i 1 it is removed and an arming command is 
received. The barrier of this S&A device is between the initiator and booster. 
Resistors are provided as an integral part of the primary safety device so 
that complete checks of the electrical system can be conducted from the power 
supply up to the electrical initiator. The resistors are designed into the 
devices so that electrical circuit checks can be made without utilizing a 
simulator. Using a simulator requires that the electrical connectors must be 
made and broken several times resulting in a reduction in reliability and safety. 
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2.3 Uses of Safety Devices 


It is preferable to standardize the devices in any vehicle where many primary 
safety devices are used since a greater degree of reliability and safety can 
be assured. Many more tests may be made on one type of device than could be 
made on several types; thus, a high reliability factor can be maintained. 

S&A devices are used in all explosive systems where inadvertent initiation 
would result in an accident of catastrophic proportions; e.g. , inadvertent 
engine ignition or inadvertent initiation of the destruct system. An S&A is 
utilized where both electrical and explosive (or pyrotechnic) safety is required. 

An arm-disarm device is usually used for stage separation. If the staging joint 
is a compressive type joint, inadvertent initiation of the stage separation 
system would not result in collapse of the missile. If the missile does not 
incorporate a compressive type joint, and if inadvertent initiation tends to 
result in a missile collapse, then an S&A device should be used. 

The thrust termination system could use an arm-disarm device since inadvertent 
initiation would not result in a catastrophic accident. There are no standard- 
ized methods of determining whether an S&A device should be used or an arm-disarm 
device; the entire system must be studied. The type of damage that would occur 
if the initiator inadvertently went off must be determined; e.g., would the 
complete missile be destroyed? would personnel be injured? would there be 
damage to property? The final decision must be made on the basis of the degree 
of safety required and the possible results of an inadvertent initiation. 

3.0 SAFETY CRITERIA FOR ORDNANCE COMPONENTS 

There are many safety criteria for ordnance components. All of the following 
apply to S&A devices and all but the first criterion apply to arm-disarm switches. 

• Detonator Safe 

There is one requirement of an S&A mechanism that is not required of an 
arm-disarm device; it must be "detonator safe." Detonator safe means that 
if the sensitive elements are initiated in the safe position, the subse- 
quent explosive or pyrotechnic train will not be initiated. A mechanical 
barrier between the sensitive material and the charge accomplishes this 
i nterrupt i on. 
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® Safety Pin 

A safety pin must be utilized for the transportation, handling, or assembly 
of the primary safety device. This safing pin has a special purpose; if 
arming power is on the system, the pin cannot be removed. The pin, of 
course, is removed prior to launch. If a technician attempts to remove the 
safing pin from the safety device and finds that he cannot, it is an indi- 
cation that something is wrong with the system and that corrective action 
must be taken. 

• Not Manually Armed 

Primary safety devices should be designed so that they cannot be manually 
armed but they may be manually disarmed. This important safety require- 
ment is to prevent inadvertent manual arming of the system. If an abort 
or system failure occurs prior to launch and the systems have been armed 
(electrically), it may be necessary to manually disarm the safety device. 
This can be done by reinserting the safing pins which automatically move 
the safety device back to the "safe" position. 

• Remotely Armed or Disarmed 

It is mandatory that the safety devices can be armed or disarmed remotely. 
There should also be a remote monitor circuit in series with each of the 
safety devices so that any movement of the devices toward the "arm" 
position will cause an alarm or a power shutdown. 

• Visual Indication of Status 


A visual indication at the mechanism of the "arm" or "safe" status of the 
unit is required. This is a redundant (but necessary) feature. When a 
technician is required to remove or insert the safing pins, he must be 
able to determine visually the "arm" or "safe" status of the primary safety 
dev i ce. 


• Electrically Disconnected in "Safe" Position 

Squibs and detonators should be shorted-out in the "safe" position; i.e., 
they are electrically disconnected. This is a guard against spurious 
currents, as well as accidental closing of the circuit, and subsequent 
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• Isolation 


Physical and electrical isolation of the firing circuits is required. That 
is, the actuation and monitoring circuitry and the firing circuitry should 
be physically separated. The circuits should be in different electrical 
connectors to guard against mismating or bending of connector pins which 
could bypass the safety device. This would cause a hazardous condition. 
Therefore, it is best to have the monitoring and activation circuits 
physically separated from the firing circuits (not only in the connector 
itself but also in the internal wiring of the primary safety device). 
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• One Amp No-Fire Characteristic 

The EED should not fire if subjected to the electrical power of 1 watt, 

1 amp for a limited time. Range Safety requires that the EED be subjected 
to 1 watt, 1 amp for 5 minutes without firing for acceptance. 

• Hi gh Rel iab i 1 i ty 

The final requirement is that the safety characteristics be demonstrated 
to a reliability of 99.5% at a 95% confidence level . This value is wi th 
relationship to the 1 watt, 1 amp no-fire characteristic of the detonator 
safety criterion. 

4.0 MISSILE ORDNANCE WIRING 

In ordnance work, people have always been most concerned with the initiator 
rather than the complete ordnance system; however, ordnance goes much further 
than this. All components which make up the ordnance system (power supply, 
cabling, primary safety device, etc.) must be studied. You cannot look at the 
initiator alone and say, "This is it, if this is safe, everything else is safe. 
It may not be truej 

There are requirements placed on the wiring circuits for additional safety: 

• Selected Routing or Isolation 

Isolation requires the electrical and physical isolation of the firing 
circuits and other power control and electronic circuitry. The selected 
routing of missile ordnance wiring through airborne cables and conductors 
is required. The monitor and actuation lines or wires should not be nexc 
to, or intertwined with, the firing circuits. 

• Twisted and Shielded Wires 

Twisting and shielding of firing circuits must be provided to shield them 
from all internal and external (audio and RF) electromagnetic fields. 

• Thermally Insulated Wires 

Thermally insulated wire should be used to preclude short-circuiting the 
critical ordnance circuits. 

• G rounded Wi res 

Static grounding and RF bonding must be provided in accordance with 
MIL-B-5087. The grounding points must be selectively established to 
reduce inductive stray electrical energy coupling paths and to reduce 
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the maximum effective antenna aperture formed by the firing leads. Range 
Safety requires that twisted, shielded wires have the shielding grounded. 
The object is to eliminate ground loops in the system. If the shield is 
isolated, there may be differences in the static potential which cause 
current surges in the field itself. Grounding the shield can eliminate 
these loops in the wiring, with the shield acting as the conductor. All 
various lead wires must be grounded to a common ground in the missile. 


5-0 DESTRUCT SYSTEMS 


There are two types of destruct systems that must be on each missile. The 
first provides a capability to command destruct the vehicle. The second serves 
a premature stage separation destruct function. If there is a mishap in an 
upper stage (such as inadvertent separation or ignition, or a physical breakup), 
the stages below the mishap must be destroyed and the stages above must be 
capable of being command destructed. 


The tendency on multi-stage vehicles has been to have the propulsion contractor 
for each stage also furnish the destruct system for that stage. Because of the 
different types of destruct systems which result from this kind of action, the 
integration of the overall vehicle destruct system becomes very difficult and 
results in a degradation of both safety and reliability. In order to overcome 
this, some missiles use an integrated system wh i ch provides an identical destruct 
charge on each of the stages with a single command destruct S&A and identical 
premature stage separation S&A mechanisms on each stage. Because of the com- 
monalty of the destruct system, the components can be tested to demonstrate 
high reliabilities (a minimum of 99*5% at a confidence level of 95%). 
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A typical integrated destruct system features a single command destruct S&A 
with interconnecting primacord and linear shaped charges. Each system is 
identical on each stage. Premature stage separation (PSS) S&As are provided 
on a 1 1 except tne upper stage. ine PSS S&A is 1 anyard— ope rated with the lan 
bridging the interstages. In the event of a premature initiation of the rocket 
motor or physical breakup across the interstage, the lanyard is pulled and 
rotates the sensitive explosive component into line. Simultaneously the laynard 
closes a series of switches between the battery and the PSS S&A thereby permit- 
ting current to flow to the detonator thus initiating the destruct system on 
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the stage and the stages below. The upper stage or stages can be destroyed 
by initiating the destruct S&A. The system is completely redundant so that 
a high reliability is achieved. 

6.0 HAZARDS TO ELECTR0-EXPL0S I VE DEVICES 

Electro-explosive devices (EEDs) require protection from the following sources: 
test equipment, electrostatic discharge, electromagnetic fields, and induced 
voltages. 

6. 1 Test Equipment 

The electrically initiated explosive components should have a minimum of one 
ampere no-fire and 3-5 ampere all-fire characteristics. The 1 amp no-fire 
requirement means that the initiator can be subjected to 1 ampere current for 
some period of time and it will not fire. The 3-5 ampere all-fire means that 
the initiator should fire 100% of the time when subjected to 3-5 amperes. The 
first is a safety requirement; the other is a reliability requirement. The 
requirements as delineated by Range Safety would be 1 watt, 1 ampere no-fire 
for 5 minutes to demonstrate the no-fire level. If possible, all initiators 
should be subjected to 1 watt, 1 ampere for 5 minutes in order to cull out 
the units which are marginal. It is necessary, however, to test the initiator 
to determine whether repeated applications of 1 watt, 1 amp no-fire for 5 min- 
utes would degrade the system. 

6.2 Electrostatic Discharge 

Presently EEDs are designed such that they will not be initiated by a capacitor 
charged to about 3 kilovolts. The possibility of having this large a charge 
build up accidental ly is rather remote. At the present state-of-the-art, the 
possibilities of going to higher initiation voltages are impractical. With 
very high voltage discharges (20 or 25 KV) the dielectric in the initiator 
would break down and the system would be overdesigned. 

There has been quite a bit of literature which shows that the human body can 
actually store up to 600,000 ergs; however, there isn't 1 00% ef f i c i ency in 
transfer. There is a loss when an EED is initiated under electrostatic dis- 
charge. It is presently possible to prevent static accumulations of a few 
kilovolts, so there is no need to go to higher discharge voltages. 



6.3 Electromagnetic Fields 


Air Force Document 80-2 defines the e 1 ect romagnet i c environment as 2 watts 
per square meter up to 50 megacycles (me) and 100 watts per square meter from 
50 me on up to 40,000 me. The ordnance system must be designed to survive 
in these electromagnetic environments; i.e., exposure to these specified 
environments must not result in any safety problems in handling, transportation 
installation or operation. 

Further exposure to the specified RF environment should not result in degra- 
dation to performance and should not reduce the reliability of the device to 
perform its intended function. 

The field that the initiator actually receives depends on the shielding of 
the system itself. It depends on the attenuation in the cabling and the 
attenuation due to the physical location of the unit in the vehicle itself. 

It is possible to have a field intensity of 100 watts per square meter and, 
due to attenuation, have a value much less than that at the unit itself. For 
this reason, the tests should be done on a complete system. Individual com- 
ponents may not be able to meet requirements when sitting on a table and being 
subjected to 100 watts per square meter; however, when they are actually 
mounted in the way in which they are to be used on the vehicle, they may be 
so shielded that they can withstand the field intensity requirement of 100 
watts per square meter. 

7.0 POSSIBLE SOLUTIONS TO ELECTROMAGNETIC HAZARDS 

There have been three possible solutions to electromagnetic hazards. One is 
the exploding bridgewire system (EBW) which is a high voltage and high energy 
system. The second is a low voltage - medium energy system; a hot wire system 
known as the 1 ampere no-fire and I watt no-fire for 5 minutes. The third one 
is a low voltage - high current with RF suppression. 

There is not much difference in the energy requirements between the low voltage 
medium energy systems and low voltage - high current systems. The current 
requirements are within the realm of a missile power supply; there is only a 
slight difference in the amount of current required. The differences, for 
instance, would be about 3 - l/2 amps all-fire for a conventional hot wire versus 
about 12 amps on high energy or medium energy initiators. 


3-9 



7. 1 The Exploding Bridge V/i re (EBW) Approach 


One attempt to meet the RF requirements resulted in EBW systems being utilized 
in missile and space vehicle ordnance systems. EBW systems were initially 
developed for nuclear weapons because of the fast firing time (less than 5 
microseconds) which could be realized. The EBW initiator can meet the RF 
requirements and uses only secondary explosives or pyrotechnics. The problem, 
of course, is that the initiator may not be sensitive but the firing unit is 
sensitive to RF radiation. The firing unit can be triggered by RF while the 
initiator itself is relatively safe. Much effort has been expended in 
shielding the firing unit against electromagnetic radiation. 

An EBW consists of an RF filter, a transistor inverter, a high voltage trans- 
former, a rectifier, a capacitor, a trigger gap switch, and the EBW initiator. 
The RF filter eliminates stray RF signals. The transistor inverter forms an 
apparent AC signal from the DC power and the high voltage transformer steps 
the voltage up to a few kilovolts. The rectifier increases the current in 
the high voltage and also converts the AC back to DC. The capacitor stores the 
energy which, when the proper signal is received, sparks across the trigger 
gap switch and ignites the EBW initiator. 

In addition, a monitor circuit is provided for monitoring the capacitor anc 
for bleed-off of the system. The bleed-off circuit is required in the event 
of an abort after the capacitor has been charged; if this happened, it would 
be necessary to bleed-off the charged capacitor. One of the drawbacks in 
the system is the time required to bleed the charge off the capacitor. This 
time for bleed-off (approximately 30 seconds) is a safety hazard. V/i th other 
systems (Safe and Arm Devices) the system can be safed in milliseconds. 

The firing pulse goes through a trigger discrimination circuit into a pulse 
forming network. These are coded signals which are required for initiation 
of the trigger switch. The pulses have a certain shape and amplitude and the 
trigger switch will react only to this type of signal; this eliminates initia- 
tion by spurious signals. The trigger gap switch, however, is susceptible 
to radiation and, therefore, shielding of the EBW firing unit is required. 

The number of electronic components in series, however, tends to degrade the 
reliability of the overall system. 
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7.2 The Low Voltage - Medium Energy Approach 


The one-watt system is basically a one-ohm bridge wire with a desensitized 
bridge wire head or a heat sink around the bridge wire to conduct the heat 
away from the sensitive explosive elements. However, the one-watt requirement 
has no physical meaning when compared with a full intensity requirement of 
100 watts per square meter which is the human tolerance level. There has been 
some disillusionment with one-watt no-fire systems even though much time and 
money has been spent in their development. 

The Range requirements are that the EED shall withstand a field intensity of 
100 watts per square meter over a frequency range or meet the Range require- 
ments. It is the belief of most people that the environmental requirement 
of 100 watts per square meter is more realistic than the one-watt no-fire 
requi rement. 

There are four main advantages to using the low voltage - medium energy EED 
system: : 

• It meets ETR requirements. 

• It can be used in combination with an arm-disarm switch. 

• On-board power can be used (28 volt power supply and conventional cabling) 
The high voltage transmission lines that are required in the EBW system 
are not necessary for this type of system. 

• It is a lighter weight than the EBW type. 

There are also, however, disadvantages to using the low voltage - medium 
energy EED system: 

• The system requires the development of a new initiator. 

• Even though the EED meets the one-watt requirement, it may not meet the 
actual field intensity requirements of 100 watts per square meter. 

7.3 Low Voltage Approach 

The low voltage - high current, with RF suppression is another attempt to over 
come the electromagnetic hazards problems. The attempted solution here has 
been in the introduction of attenuators in the initiator plug or in close 
proximity to the initiator. This work has been carried on by the Navy and the 
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Army using enclosure and suppression techniques. The major problems have been 
in incorporating a suppression technique of reasonable size. 

The low voltage system affords the maximum prelaunch confidence checks as 
compared with an EBW system. The firing discrete signals can be checked 
through a simulator resistor in the primary safety device without checking 
through the initiator itself. This' permits a system self-check while the safe 
and arm mechanism or arm-disarm mechanism is in the "safe" position. The safe 
and arm status of the system can be commanded remotely. The system can be 
immediately safed if a launch abort occurs. Most of the safe and arm mechanisms 
and arm-disarm switches can be safed in 40 to 100 milliseconds, compared to the 
20 to 30 seconds required to bleed-off the EBW systems. The arming and safing 
capability may be checked prior to launch during systems checkout tests. An 
EBW system cannot be armed without charging the capacitors. . 

The 1 ow voltage - high current system with RF protection has many advantages: 

• It meets both the Eastern Test Range and Western Test Range requirements. 

• It can be used with an arm-disarm switch and safe and arm device because 
it uses missile on-board power. 

• Existing initiators can be used. 

• The RF protection attenuators can be mounted in or around the existing 
initiators. 

As is the case with all systems, however, this device also has its disadvantages 

• The RF suppression system must be integrated with the initiator. 

• It is necessary to certify the initiators over the frequency range of 
10,000 to 40,000 me. This is extremely difficult to do because there is 
no test equipment available for direct test at these frequencies. 

8.0 CONCLUSIONS 

The design of the ordnance system is not the design of the initiator alone; 
the overall system must be studied. It is necessary that the ground equipment 
which provides the signal must be studied. The cabling, power supplies, cable 
routing, shielding requirements, and grounding requirements must all be included 
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As systems become more and more complex and more and more ordnance items are 
used on missiles and space vehicles, the hazards compound because of the 
additional units that must be incorporated into the system. In order to 
assure safety and reliability - which go hand in hand - it is necessary to 
look at the total system and not individual components. Testing and analysis 
must be done on a total system basis. 


Lecture Number Four 


"SENSITIVITY OF EXPLOSIVES AND PROPELLANTS 
TO IMPACT AND FRICTION" 

Mr. Frank Fedowitz, Jr. 



1.0 INTRODUCTION 

Most readers who have worked at Cape Kennedy for a period of time are well-aware 
of the developments that have taken place in recent years in the field of bigger 
and better boosters. These larger boosters have required developments of higher 
and higher energy propellants. In the past, there was a great difference between 
propellants and explosives; but, as a result of the development of newer propel- 
lants, the line of demarcation, or difference, between propellants and explosives 
is not as great as it was before. Primarily, this is because they either contain 
fair percentages of explosives, or behave in a similar manner to explosives, 
especially inadvertently. 

2.0 INITIATION OF EXPLOSIVES AND PROPELLANTS 

Safety is of paramount importance in the manufacture, the test, and the use of 
propellants and explosives. One index of the safety, of these materials or com- 
ponents containing them, is sensitivity. In order to understand the importance 
of sensitivity and the variations in sensitivity, one must have some background 
of the process, from the point of initiation of explosives and propellants to 
either deflagration (burning) or detonation. 
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Figure 4-1 
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Figure 4-1 is a graph i cal rep resentat ion of what occurs from the time a propellant 
or explosive item is initiated, to the time it is progressing at a steady state. 
The process starts at the initiation point (at time zero), through action of a 
squib, a detonator, or an inadvertent initiation. As time progresses, the 
reaction accelerates. In the case of a deflagration or a burning process, (for 
propellants), this reaction proceeds at a rate of a few inches per second and 
at a pressure of perhaps 1,000 psi . In the case of an explosive, or a propellant 
which is misbehaving, a sudden change in reaction rate occurs which leads to a 
detonation. The reaction rate in a detonation process is very rapid, in the 
order of 600 to 2,400 feet per second. The pressures associated with this rate 
are in the neighborhood of one hundred thousand atmospheres. Obviously, there 
is a great difference between deflagration and detonation. A knowledge of the 
conditions of initiation is very important; primarily, in the case of whether 
one does or doesn't want it to occur. There have been numerous initiation studies 
of propellants and explosives; and of course, everyone who has studied the phenom- 
enon, has proposed some sort of test to determine the sensitivity characteristics 
of the material. There are as many tests as there are studies of initiation. 

One of the primary factors to understand, is that initiation requires a given 
input of energy into the system, usually a rapid input of energy, and not neces- 
sarily heat energy. The energy input can be through impact, frictional forces, 
a number of miscellaneous forms, and of course, heat. 

2 . 1 Impact Energy 

Heat is produced if an explosive or propellant is impacted. This may be caused 
by the flow of the materials due to the impact, a compression of gas or vapor 
bubbles in the material, or shearing of different portions of the propellant or 
explosive: all of which tend to form "hot spots." "Hot spot," a term used in 
explosive work, is considered to be a small area in the propellant or explosive 
where the input energy is concentrated. The "hot spot" theory is the presently 
accepted theory of initiation for propellants and explosives. 

2.2 Friction Energy 

Frictional initiation is another means of initiation and is actually similar to 
impact. It is attributed to the formation of hot spots, similar to those formed 
by impact, except for the rates of formation and method of energy supply. 
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2 .3 Thermal Initiation 


Thermal initiation is caused by heating the propellant or explosive to the point 
where it decomposes and/or ignites. 

2 .h Miscellaneous Causes for Initiation 

Initiation may also be brought about by electrostatic discharge, gamma radiation, 
ultraviolet radiation, or visible radiation. Radiation is considered to decom- 
pose the material into more sensitive compounds, which then are more sensitive 
to previously mentioned types of input energy. 

3.0 SENSITIZERS AND DESENSITIZERS 

The sensitivity of a material can be affected in a number of ways, some of which 
are discussed in the following sections. 

3 . 1 Mechanical Sensitizers 

Perhaps the most common sensitizing effect is a mechanical effect. A hot spot 
could be formed around a particle of grit, a piece of sand, or other materia' 
mixed in with the propellant or explosive. The properties of the grit are very 
important; hardness, shape, size, and most important, its thermal characteristics. 
The melting point of the grit particle is important. When an impact, or a 
frictional force is applied, a hot spot starts forming at the site of the grit 
particle. If the melting point of the grit particle is low, before the hot spot 
can build up to a high enough temperature to initiate the propellant or explosive, 
the particle may either decompose, or melt, and eliminate the source of the hot 
spot. If, on the other hand, the melting point of the grit particle is higher 
than the melting point of the explosive or propellant, the temperature of the 
hot spot will increase to a point where the propellant or explosive will be 
initiated. Another type of mechanical source of initiation which has to be con- 
sidered, especially during assembly-type operations, is the screw thread. A bit 
of propellant or explosive in a thread can be subjected to a localized high’ energy 
input, and can easily be a source of initiation as the mating part is assembled 
to it. 

3.2 Chemical Sensitizers 

A second method of sensitization is achieved by means of chemicals. Chemical 
sensitizers tend to lower the decomposition energy of a material. For example, 
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consider copper and ammonium perchlorate combinations. When copper is in contact 
with ammonium perchlorate, it lowers the decomposition temperature of the ammonium 
perchlorate. As another example, copper in contact with ammonium nitrate directly 
increases its sensitivity. Therefore, in any design work or fabrication of these 
assemblies, copper is kept from contact with either ammonium nitrate or ammonium 
perchlorate. In order to check the compatibility of different materials with 
explosives and p rope 1 lants , a type of compatibility test is run between the pro- 
pellant or explosive and any material that may come' in contact with them. The 
test is usually conducted at an elevated temperature in which a test tube size 
sample, or larger, is subjected to elevated temperature, and decomposition products 
are measured after a period of time. Double base propellants, nitroglycerin or 
nitrocellulose containing propellants, have their own problems also. They tend 
to decompose slowly, producing an acid product which tends to increase the sensi- 
tivity. However, stabilizers are incorporated in these propellants which selec- 
tively react with the decomposition product, and remove them from the system, so 
they do not have an adverse effect. 


3.3. Physical Sensitizers 

A third method of sensitization or desensitization is a physical method. Tempera- 
ture changes, either high temperatures or low, can cause changes in the crystal 
size of an explosive or propellant, thereby either sensitizing them if they are 
sensitive to their crystal size or desensitizing them. Of course, as temperature 
increases, reaction rate increases, so the temperature has a direct sensitizing 
effect . 


4.0 MEASUREMENT OF SENSITIVITY 

One might think that there should be a correlation between the 
required to initiate a materia! and its output energy. Figure 
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Figure 4-2. SENSITIVITY VS. BRISANCE (OUTPUT) 
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Lead Azide RDX 
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RDX TETRYL 

TETRYL TNT 

TNT Lead Azide 

(Other test methods will produce some rearrangement.) 



the input/output relationships for a few of the normal military explosives. 

Lead Azide, for example, shows a relationship of a high impact sensitivity for 
a low Brisance or output. Brisance, by the way, is a term for shattering power 
of the explosive. There may be some inverse relationship for Lead Azide, but 
for the other explosives the relationship does not exist. It becomes apparent 
from Figure 4-2, that there is really no correlation that can be made between 
input and output power. How then does one measure sensitivity? A number of 
effects regarding sensitizers and desensitizers have been mentioned and the many 
ways in which the sensitivity of propellants or explosives may vary has been 
explained. One may be led to believe that it might be a bit difficult to measure 
the sensitivity of a material accurately. This is definitely true. Most testing, 
thus far developed, has been developed toward the aim of trying to resemble field 
conditions and actual operational type conditions. 

4. 1 Types of Tests 

Figure 4-3 is a partial list of tests. Of the twelve tests listed, the twelfth 

Figure 4-3. SENSITIVITY TESTS 

1. Impact Test (falling weight) 

2. Friction Test (sliding weight) 

3. Card Gap Test 

4. Bullet Impact Test 

5. 40 foot Drop Test 

6. Minimum Detonating Charge 

7. Critical Diameter 

8. Electrostatic Discharge 

9. Auto Ignition Temperature 

10. Vacuum Stability Tests 

11. Differential Thermal Analysis 

12. Et Cetera 

one is the most complicated; it consists of twenty or thirty more tests that 
have been used throughout the industry. Everyone has some sort of test, that 
they think is the best test, for measuring a particular type of sensitivity. 
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Three of these tests use heat input as a means of initiation; Numbers 9, JO, 
and 11. Four use impact of one sort or another; Numbers 1, 2, 4, and 5- Three 
use detonability of the propellant or explosive as an indication of its sensi- 
tivity; Numbers 3, 6, and 7- Number 8 is a measure of the electrostatic 
sens i t i vi ty . 

e Thermal Testing 

In thermal sensitivity testing, temperature is usually the parameter that 
is being looked for; i.e., temperature at which a reaction occurs, or the 
time at which reactions occur at certain temperatures. The auto- i gn i t ion 
test, for example, is a test in which one looks for flame, or detonation 
or initiation of some sort, to occur at a particular temperature. The 
differential thermal analysis test is similar to the auto-ignition test, in 
that its criteria involves heat generation; but in addition to flame, other 
heat generation. Thermogravimetr i c analysis is one of the et ceteras in 
Figure 4-3, and looks for a weight change as the sample is heated. There 
are many sources of variability in these types of tests. One can imagine 
that the heating rate, the sample size, compaction of the sample, and the 
material from which the container is made, all affect the result. These 
variations require that anyone, who is going to make a comparison between 
tests, must be careful, and be sure they ha /e all the data and know all 
the differences between the different tests before a valid comparison 
between tests can be made. 

• Impact Testing 

The next type of tests is the impact tests and, as in the case of the 
thermal tests, comparison here again is very difficult. Results are some- 
times ambiguous and there are many variations in the testing. The "hot 
spot" theory states that one has to produce localized heat at a fairly high 
rate in order to initiate a compound. Therefore, the method of energy 
application is important, and the mechanics of the apparatus itself enter 
into the variations in the results that one obtains. For example, the 
hardness of the material, the finish, the thermal characteristics are again 
important. In addition, there are problems with the decision standards 
that are used in these tests. Many people use the "Three S system," (Sight, 
Sound, and Smell), to determine whether a reaction has taken place or not. 
Some others may be a bit more sopn i st i ca Leu arid use measuring devices — but 
these also have variations. 

4.2 Impact Sensitivity and Tests 

In impact testing, before the "hot spot" theory was developed, people thought 
that impact either produced a direct excitation of the explosive or propellant 
molecules or a rupture of the molecules themselves. The "hot spot" theory, 
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however, states that rapid, localized heating of the material is required to 
effect initiation. Figure 4-4 is an example of one of the pieces of test 
apparatus that is used for determining the impact sensitivity of a material. 

This is the Picatinny Arsenal standard apparatus. It is not an extremely compli- 
cated piece of equipment, nothing more than a weight that is suspended on a 
calibrated stand and then dropped onto an assembly, containing the material under 
test which is supported on an anvil. Figure 4-5 is another example of an impact 




Figure 4-4. PICATINNY APPARATUS Figure 4-5. BUREAU OF MINES APPARATUS 
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apparatus; it is the Bureau of Mines impact apparatus. It looks somewhat more 
sophisticated than the Picatinny Apparatus, but is actually no better. In a 
few instances, it does not produce quite as good results. There are many 
variations in impact sensitivity which can occur. One of these variations is 
due to temperature and is shown in Figure 4-6. When the impact test is per- 
formed at varying temperatures, the'impact height, the height to which the 


Figure 4-6. EFFECT OF TEMPERATURE ON IMPACT SENSITIVITY 
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PICATINNY ARSENAL IMPACT TESTER 
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weight has to be -aised in order to set off the explosive or propellant under 
test, varies very widely with respect to temperature. The tests were performed 
on some of the standard military propellants and ammonium nitrate. The aster- 
isked numbers indicate those 'tests in which the material was in the molten state. 
One can see that the molten material is extremely sensitive. Within the general 
using range of the explosives or propeiiants their sensitivity is relatively 
constant; i.e., up to 170°F. A number of variables have been mentioned, because 
the measurement of sensitivity is fraught with variables. For example, with an 
impact apparatus, if one has nicely polished steel surfaces and tests a primary 
explosive like mercury fulminate (a primary explosive being one which is very 
easily set off by heat or impact and is used in initiators), it usually explodes 
at a height of about two centimeters, on the Picatinny apparatus. PETN initiates 
at a height of approximately 15 centimeters and RDX at a height of 25 centimeters 
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or so. TNT generally does not initiate on the Picatinny apparatus when using 
polished steel surfaces. All one has to do, is to add a thin layer of tin foil 
over the TNT and it becomes almost as sensitive as RDX, so the tin foil, just 
in intimate contact, tends to act as a physical sensitizer. Wax is another com- 
pound which may sensitize or desensitize a material. If wax is put on the 
surface of the sample being tested, it may lower the impact height (increase 
the sensitivity). But if wax is mixed intimately into the material it acts as 
a desensitizer, a very good desensitizer, and is in standard use in military 
explosives such as RDX and Composition B. Most foreign materials, when added 
to explosives or propellants, tend to desensitize, only if they have low melting 
points and they are not gritty substances, as was mentioned before. With all 
these variations in testing, when one tries to analyze the results in order to 
gain either a no-go point or an all-go point (all-fire point) the results 
usually fall in a normal distribution or S-shaped curve. See Figure 4-7. 


DISTRIBUTION 

OF 

SENSITIVITY TEST RESULTS 



For example, assume that the impact apparatus is being used. The norma! pro- 
pellant no-fire point will be at one extreme, and as the impact height is 
increased, one starts getting more initiations. An S-shaped curve will slowly 
form, until the 100% point is reached, at which time the curve levels off. It 
is a fairly flat curve, or a gradual sloping curve, in most actual circum- 
stances. What is really desired, is a fairly steep curve; wherein the no-go 
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point is fairly close to the all-fire point. This may be approached by cleaning 
up the test methods and trying to standardize methods thereby minimizing vari- 
ations. The designer, or user, of a system containing detonators or squibs, wants 
to know the no-fire or all-fire characteristics extreme detail; with a high reli- 
ability at a high confidence level. If it is a 1 amp no-fire squib or detonator, 
one wants to be sure it does not go off at 1 amp. One method, other than running 
thousands of tests in order to arrive at a high reliability, i.e., thousands of 
tests subjecting each squib to 1 amp, is to use what is called the Bruceton analy- 
sis. The Bruceton or staircase analysis method is shown below. 

BRUCETON (STAIRCASE) METHOD 
FOR DETERMINATION OF 
ALL FIRE / NO FIRE POINTS 

DROP FIRE 



X- FIRE 
O-NO FIRE 


Figure 4-8 


In this method, one chooses a variable; such as the drop height, in the drop 
test machine, or a current varying around the 50% fire current of a squib. A 
series of tests is run, in which each time one gets a no-fire, he will either 
increase the current, or increase the drop height. Each time one gets a fire, 
he will decrease the current, or decrease the drop height. A Bruceton analysis 
is run, usually with many more than the 18 tests shown in the figure. From this 
series, as can be seen on the right side, a distribution of results is obtained 
from which a determination can be made as to where the mean value lies and the 
variability around the mean. Once the mean value is obtained, using statistical 
processes, one can derive, with a high reliability, results which show that no 
detonation or no firing will occur at a certain point. For example, in this 
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instance, one may get an answer that, with a 99/ reliability at 90/ confidence 
level, no samples will fire when the weight is dropped from 1 centimeter. The 
main advantage of the Bruceton analysis, is to reduce the number of test items 
required for a given reliability. One can imagine, that if the items cost 
$1,000 apiece, it would be senseless to shoot up a thousand items; especially 
if he can get the same or equivalent result with 50 items. Determining no-fire 
characteristics and all-fire characteristics is a very important analysis with 
regard to safety. 

4 .3 Frictional Sensitivity and Tests 

Fri ction sensitivity, as was mentioned earlier, is similar to impact, in the 
sense that it is explained by localized hot spots being produced. Figure 4-9 



Figure 4-9. PENDULUM FRICTION TEST APPARATUS 

illustrates one piece of apparatus that is used in determining friction sensi- 
tivity of a material. It consists of a pendulum with a weight, attached to the 
end is a friction shoe, (either a fiber shoe or a steel shoe), and the friction 
anvil, which is a serrated or grooved anvil, on which some explosive is placed. 
The test is performed by releasing the pendulum and allowing it to brush across 
the anvil; determining through use of the Three S system, how many initiations, 
snaps, crackles or pops occur. Usually, one tests about 10 samples and the 
results are turned out as the number of initiations per the ten samples, or 
percentage of initiations. There is not much of a correlation between the 
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results one obtains from the impact test or the friction test. The only thing 
that can be said about it is that the friction test appears to use at least as 
much kinetic energy as the impact test. 

4.4 Bui let Impact Test 

The Bullet Impact Test is a combination of friction and impact. It utilizes a 
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Figure 4-10. BULLET IMPACT TEST BOMB 

very complicated piece of equipment; a piece of pipe with two end caps screwed 
onto it. This type of test may seem to have more of a military value. But it 
does produce results, wh i ch do tend to fall into the same category as friction 
and impact sensitivity tests. This test is performed with a piece of explosive 
loaded pipe and, at a range of 30 yards, a .30 caliber bullet is fired into it; 
determination is made whether the explosive initiated, burned, or what did 
happen. Obviously, a test like this supplies much more energy, to the material 
being tested, than the friction test or the impact test. The sensitivity of a 
material undergoing this test, depends very much on the strength of the con- 
tainer and some of the physical properties of the material itself. For example, 
if one takes pure, loosely packed, powdered RDX or Composition B, these will 
usually be initiated by bullet impact, even if they are simply contained in a 
paper container. Only the very insensitive materials fail to initiate in this 
test, unless heavily encased; for example, TNT. In general, regarding sensi- 
tivity, a low density powder tends to be more sensitive than a cast material; 
which in turn, is somewhat more sensitive than a very highly pressed material. 
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Under some relatively standard conditions for the bullet impact test, the normal 
ratings of the common explosives (from lower sensitivity to increasing sensi- 
tivity) are: TNT at the least sensitive end; Composition B, Tetryl, RDX and 

PETN at the more highly sensitive end. This is approximately the same order 
that results with the impact and friction type machines; primarily the impact 
machines. A side effect, however, comes into being with the bullet impact 
test - size. TNT didn't show reproducibly in a small bullet impact test; however, 
a large bomb filled with TNT will almost always go off with at least a low 
order detonation. Aluminum is a sensitizer when it comes to the bullet impact 
test, especially in large charges. This can be explained due to the aluminum 
particles causing numerous hot spots in the material. 

4.5 Heat Sensitivity and Tests 

Heat, as was said earlier, tends to cause the c ecompos i t ion of a material and 
increases the rate of reaction as the temperature increases. Most propellants 
and explosives exhibit a critical high temperature, below which the material is 
very stable and above which it becomes less stable. Nitroglycerin, for example, 
has a temperature in the area of about 125°F. Above 125°F, it starts under- 
going some adverse changes after a period of time; whereas below 125°F, there 
are no effects due to aging. TNT and Tetryl, and a number of the other highly 
used military explosives, have critical temperatures up in the hundreds of 
deg rees . 



Figure 4-11. EXPLOSION TEMPERATURE TEST APPARATUS 


Figure 4-11 illustrates one of the pieces of equipment used for determining 
explosion temperature. It is a relatively simple arrangement, primarily an 
electric furnace, in which is put some Wood's metal, (a low melting point metal 
that is used in sprinkler systems for fires), and an empty blasting cap shell. 
The explosive, or propellant, is loaded in the shell and is lowered into the 
molten Wood's metal. The object is to try to obtain the temperature at which 
flashes, detonations, or reactions occur. The test is run over a small range 
of temperatures, then it is determined at what temperature the test sample 
exploded in a five-second period. The five-second temperature is one of the 
standard ways of recording this sensitivity. Another similar method, uses 
molten Wood's metal on which particles of the material are dropped, and, using 
the Three S system, it is determined whether or not it reacted. 

4.6 Spark Sens i t i vi ty 

Another type of sensitivity test is electrostatic sensitivity testing. We are 
all familiar with the fact that electroexplosive devices tend to be sensitive 
devices, when it comes to electrostatic discharges. One, therefore, protects 
against electrostatic or arc discharges across electroexplosive devices. As 
far as explosives and propellants are concerned, there is no standardized type 
of test. The results of some tests are shown in Figure 4-12. 

SENSITIVITY OF EXPLOSIVES 
TO 

ELECTRIC SPARKS 


HAZARDOUS 

NOT HAZARDOUS 

Black Powder 

PETN 

Lead Azide 

RDX 

Mercury Fulminate 

TNT 

Tetryl 

. .. ■ ... , ■ ■ . 



Figure 4-12 
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PETN , RDX, and TNT are relatively nonha za rdous , when it comes to electrostatic 
type discharges. A look at the hazardous side of Figure 4-12 shows, however, 
that most of the primary explosives are sensitive to electrostatic discharge. 
Tetryl , though not a primary explosive, is somewhat sensitive to discharges. 
Black powder heads the list — it is extremely hazardous when it comes to electro- 
static discharge. There is another type of sparking action which may cause an 
initiation of a material. This is the nonelectric-type spark, i.e., those 
produced in grinding operations, or hammering on another metal. Most explosives 
and propellants are hazardous with respect to this type of hot spark. This is 
one of the prime reasons that nonsparking tools are used in all assembly oper- 
ations having explosive devices. Black powder, again, tends to lead the list 
as far as being she most hazardous item. 

4.7 Solid Propellant Sensitivity 

The tests that have been discussed usually give very good correlation with 
respect to explosives handling experience obtained over a number of years. If 
an explosive shows up as a very low impact sensitive item, it usually has not 
experienced too many inadvertent initiations due to impact, and the opposite 
holds true for a highly sensitive impact item. But, when it comes to using 
some of these tests for screening solid propellants, the results do not appear 
to correlate too well with actual experience. Many times, a propellant which 
has been in standard use for a number of years looks hazardous by virtue of 
the results of an impact or friction testing machine. A number of tests indi- 
cate these propellants to be just as sensitive as some of the high explosives. 

• Card Gap Test 

Figure 4-13 illustrates a test which seems to give reasonable correlation 
with the actual handling experience of propellants. The sensitivity of the 
sample is determined by attempting to detonate it with a Tetryl booster 
which is separated from the sample by a varying thickness of inert material 
(.010 inch thick cellulose acetate cards). The greater the number of cards 
through which the shock wave from the donor detonates the sample, the 
greater is the sensitivity of the sample. This test is performed by vary- 
ing the number of cards (slowly increasing) until no detonations of the 
propellant are obtained. Points are then determined for 0, 50 and 100%. 
This, again, is suited very well to a Bruceton analysis, in order to 
arrive at highly reliable results wi th a minimum number of samples. The 
criteria for detonation of a propellant or a nondetonation are its effect 




Figure 4-13. SHOCK SENSITIVITY TEST APPARATUS 

on the witness plate. A detonation punches a clean hole through the 
witness plate, whereas a nondetonation, or a burning action, will either 
do no damage or slightly bow or dent it. Looking at the results of some 
of the double base and composite propellants, most of the composite pro- 
pellants, most of the composite propellants, po 1 yu rethene , polyvinyl- 
chloride types, do not detonate in the diameter tested. "In the diameter 
tested" is mentioned because there is a variability, which will be covered 
later, called the "critical diameter" of the material. The double base 
propellants, on the other hand, do sometimes detonate. This is especially 
true, if they have an explosive binder included within them. Then, they 
do detonate and act like explosives. 

• Defective Propellant Grains 

There is another area of concern in solid propellant sensitivity, and 
this is defective grains. Solid propellants are sometimes notorious for 
exploding, either during or after ignition. Some investigations performed 
by Dr. Bryan and his associates were concerned with the sensitizing effect 
of voids in solid p rope 1 lan ts , (ho les , cracks, or bubbles). Figure 4-14 
illustrates some of the results obtained. The vertical axis shows card 
gap test results; i.e., the higher the number of cards through which a 
detonation occurs, the more sensitive the sample is. The horizontal axis 
shows card gap test variations with temperature. A solid propellant with 
no defects looks fairly insensitive. As the number of voids start increas- 
ing, the sensitivity appears to increase. Note that there are two types 
of voids shown : continuous voids, wh i ch could be cracks that run through 
the material; and noncont i nuous voids, small bubbles throughout the material. 
There is not much variation in sensitivity, with respect to temperature, 
with the continuous voids. However, when one looks at the results for the 
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DOUBLE BASE PROPELLANT GAP TEST SENSITIVITY 
VERSUS 

PERCENT VOIDS 



Figure 4-14 

noncont i nuous voids, (or bubbles), it was initially a bit shocking to see 
how sensitive the samples became at lower temperatures. This was subse- 
quently explained along the lines that: although there may be discon- 

tinuous bubbles throughout the material, at the lower temperatures these 
materials are more brittle, and as the material is hit with a shock or an 
ignition shock, it is simultaneously heating and starting to burn, thus 
cracking the propellant. A number of small cracks running through the 
propellant, connecting the different bubbles and increasing the surface 
area, results in an essentially continuous void in the propellant. It 
is obvious then, that there is a tremendous difference in sensitivity of 
solid propellants, with respect to the number of voids or defects that are 
present in a gra i n. 

5.0 CROSSOVER PROBLEMS 

One of the problems encountered in all tests performed is called "crossover." 
Crossover is a term which explains that results obtained from one test may not 
necessarily be in the same sequence as other tests. Different type tests show 
different sensitivity relationships. The solid propellant card gap test shows 
one sensitivity and the friction or impact test is another sensitivity. (See 
Figure 4-15.) 
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RELATIVE SENSITIVITIES OF CERTAIN PROPELLANTS AND EXPLOSIVES 


BY SEVERAL TEST METHODS 
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Figure 4-15 

There is a crossover between the first two impact tests, shown on the left 
portion, between the lead azide and PETN. Normally, lead azide is an extremely 
sensitive material and PETN is somewhat less sensitive. But in the second 
impact test, the lead azide showed up as less sensitive than PETN. By the way, 
increase in sensitivity is downward on this chart. Looking at lead azide in 
the remainder of the tests, if one were to judge the sensitivity of lead azide 
only on temperature results, one might think it was a fairly safe nonsensitive 
explosive, almost as good as TNT. But one has to look at all the character- 
istics. Lead azide auto-ignition temperature is the only type of sensitivity 
that is low. Looking at the double base propellants shown in the figure, the 
shock test shows different results than the impact test. There is, again, a 
crossover between the double base and the TNT, or the others. The last test 
on the right, is an analytical evaluation of the explosives and propellants 
similar to the radioactive material critical mass. It is assumed here that a 
larger and larger diameter sphere of the explosive or propellant is constructed, 
and finally a point is reached where internal decomposition products, and the 
temperatures produced, cause initiation of the material itself. Luckily 
though, the diameters arrived at in this analysis are much larger than diameters 
being used in any missile or space system, now or in the future. -However, this 
is another method of evaluating a possible mode of sensitivity. 
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6.0 SCALE-UP PROBLEMS 

Another factor in evaluating the results of tests is the scale-up factor. It 
is the comparison of test results between small scale (few milligram samples 
up to a few pounds) to the amount actually used in full scale rocket motors. 

As was stated earlier, and as can be seen in the next figure, there is a 
parameter called the critical diameter of an explosive or a propellant. The 
cr i*t i ca I d i ame ter is the d i ameter of a material, be low wh i ch the material will 
not sustain a detonation and above which, it will sustain a detonation if it 
is initiated. RDX and PETN, on the left side of the figure, have relatively 
small critical diameters, in the area of less than a half centimeter or so, 
depending on the confinement. TNT has a somewhat greater critical diameter. 
Propellants (ammonium nitrate for example) have a much larger critical diameter 
than normal military explosives. Some propellants don't have an apparent 
critical diameter; i.e., they never detonate. Critical diameter is an import- 
ant fact in evaluating the results of sensitivity tests. Although a sample 
may show up as a nondetonable in a small diameter, it may show up as detonabie 
in the full scale application. There are a number of full scale tests that 
are important and must be performed in evaluating sensitivity of missile systems, 
as shown in Figure 4-17- These tests were for a particular missile system which 
was developed. The smaller upper stage in the left portion is known to be a 
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Figure 4-16 
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Figure 4-17- FULL SCALE TEST 


detonable propellant. The larger stage on the right was not known to be deton- 
able at the time. What was done then, in a sense, was to booster it, similarly 
to a card gap test in effect, with the upper stage as the donor. It was desired 
to find out whether the lower stage would detonate. The method used was to 
initiate the upper stage to see if it would, in turn, initiate the lower stage. 

These full scale tests are very important when it comes to the ICC and military 
hazard classification of the item for transportation and storage. This type 
of testing is important in determining the ICC and military hazard classifi- 
cation for storage and shipment. Class A, detonab 1 e-type propellant, according 
to the ICC standards has to be handled a lot more carefully than a Class B or 
burning type propellant. 

7.0 CONCLUSIONS 

in genera], in handling any of these materials, there are a few general rules, 
shown in Figure 4-18, which should be lived by when handling any propellants 
or explosive items. These rules happen to be taken directly from the explosive 
industry, but are applicable to anyone handling these materials. The prescribed 
safety regulations are usually based on as much data as possible, from all tests, 
and are usually very conservative. Assembling an item, or disassembling an item, 
should not be done near other propellants or explosives, or in an area where 



GENERAL RULES FOR HANDLING EXPLOSIVES 


1 . 
2 . 

3. 

4. 

5. 

6 . 

7. 


Consult the prescribed safety regulations. 

Conduct all work in the prescribed space, never near 
storage spaces of bulk explosives or propellants. 

Keep all work areas free from contaminants. 

Avoid accumulation of charges of static electricity. 

Avoid flame and spark-producing equipment. 

Keep to a minimum the number of personnel at work in 
the same area, but one man should never work alone. 

Be sure that the chambers for "loading" and "exploding" 
a re we 1 1 sh i e 1 ded . 


Figure 4-18 


there might be extraneous people. Reasons for keeping an area free of contami- 
nants is obvious. One doesn't want to have something sensitized by having sand 
or grit get into i t . 

Nonsparking type shoes and grounding straps are extremely important when it 
comes to electroexplosive devices. Care must be taken not to use the handy 
screwdriver you happen to have in your back pocket. Never use a steel screw- 
dr iver when working on explosive items. Keep the number of personnel down in 
an area where work is going on. That is important. Loading and unloading in 
the proper areas reduces the danger to other people. 

Modern high-energy propellants either contain explosives, in varying degrees, 
or behave in a similar fashion to explosives, with respect to input energy and 
output energy. Propellants and explosives can be handled with safety, as has 
been demonstrated in the many years of their use. However, with the number of 
new compositions being developed and the variability of sensitivity test results 
one must use care in evaluating the characteristics of an item with respect 
to its safety. 
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1.0 INTRODUCTION 

Since liquid propellants are used to produce large volumes of gases at extremely 
high temperatures, they are inherently dangerous. In some cases, the reaction 
products are also hazardous. Therefore, to prevent accidents, all personnel 
involved in operations using these propellants should be trained to handle them 
properly. .. 

Numerous liquid propellants have been successfully used and many more exotic 
propellants are contemplated in future rocket and control systems. A perfect 
propellant combination, that is, one having no undesirable qualities, has yet 
to be discovered. As a matter of fact, some liquid propellant chemists appear 
to follow the theory that if a substance is discovered which has an evil smell, 
is highly toxic, corrosive, explosive, and generally dangerous it very probably 
would make a good propellant. 

Oxidizers are notorious for being particularly corrosive and hazardous. Most 
oxidizers react readily with hydrocarbons such as paint, oils, and many other 
substances normally found around launch areas. Fuels, on the other hand, in the 
presence of air or an oxidizer, are dangerous from the fire hazard standpoint. 

2.0 PRINCIPLES OF LIQUID PROPELLANT MOTORS 

The same basic principles and calculations used in evaluating solid propellant 
motors apply to the liquid propellants. In both cases, the source of energy for 
propelling a rocket is contained as latent chemical energy. This energy is 
released during the chemical reaction. The heat from the chemical reaction is 
imparted to the gaseous products which escape through the throat area of the 
rocket motor. The nozzle provides the means for efficiently expanding the gases 
so that the heat energy is converted into kinetic energy which propels the vehicle. 

In most cases, the high combustion temperatures of liquid propellants require 
cooling of the thrust chamber and portions of the nozzle assembly. This cooling 
is accomplished by transferring the heat to one of the propellants prior to its 
i nject i on. 
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Liquid propellant systems are generally more complicated than solid motors. At 
this time, liquid propellant motors have many advantages over the solids; specif- 
ically, the capability of being throttled to various thrust levels and, of course, 
they can be turned on and off during flight. This is a definite advantage if 
in-flight trajectory correction is required. Solid rockets soon will be capable 
of reliable restarts; however, more research is needed in this particular area. 


The figure of merit used to evaluate liquid propellants is called the specific 
impulse, (l ). Specific impulse is defined as the amount of thrust in pounds of 
force delivered for each pound of mass of propellant flowing in one second. From 
a chemical standpoint, it may also be defined as being proportional to the square 
root of the heat of reaction and inversely proportional to the square root of the 
average molecular weight of the exhaust products. 



where: F = thrust in pounds - force 

w = flow rate in pounds per second 
K = mechan i ca 1 -heat conversion factor 
AH = heat of react ion 
M = average molecular weight of exhaust 

The above equation shows that in order to achieve high specific impulse, the 
chemical reaction should produce a large amount of heat per unit mass and the 
exhaust products should have as low a molecular weight as possible. This is 
why a combination of diborane (E^Hg) and oxygen difluoride (OF^) produces such 
a high specific impulse. These propellants produce high combustion temperatures 
and reaction products with a very low molecular weight. 

The oxidizer-to-fuel mixture ratio must be controlled to provide the maximum 
possible specific impulse. In some cases, a trade-off is necessary between the 
combustion temperature and the molecular weight of the exhaust products. Most 
propellant combinations produce the highest combustion temperature at the 
stoichiometric (theoretical chemical mixture) ratio. With some propellant com- 
binations, a higher specific impulse can be achieved by operating slightly on 
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the fuel-rich side. This results in a slightly lower combustion temperature 
but has the advantage of a lower average molecular weight of the exhaust prod- 
ucts, since they contain more hydrogen. This trade-off is called the "optimum 
mixture ratio." 

3.0 GENERAL PROPELLANT REQUIREMENTS 

In choosing a propellant combination for a specific mission or project, four 
major factors must be considered: economics, physical properties of the pro- 

pellants, chemical properties, and the operational requirements. 

3 . 1 Economic Factors in Selecting Liquid Propellants 

One of the primary economic factors considered in selecting a liquid propellant 
combination is cost. A large percentage of propellant research money is allo- 
cated to evaluating the hazards of the propellant system. Additionally, the 
relative cost on a pound basis and the size of the mission involved determine 
which propellant combination will be used. A large booster of the Saturn V cate- 
gory will require a large quantity of propel lan:. Approximately 5 to 7 years 
are required in developing a missile or large booster system. The large number 
of tests and static firings required during this period can become extremely 
expens i ve. 

Another factor which must be considered is the availability of raw materials 
required to manufacture the propellant. Although some exotic propellants produce 
very high specific impulses, they cannot yet be manufactured in the quantities 
necessary for engine development and qualification. Facilities and equipment 
necessary for the production of rocket propellants should be available to elimi- 
nate unnecessary delays during the engine research phase. 

3 . 2 Physical Properties Desired in Liquid Propellants 

• High density is desirable in a propellant since a greater mass can be 
carried in a relatively small airframe. Large tanks mean more weight and 
are more vulnerable to meteriod impact and the effects of solar radiation 
in outer space. 

• Low vapor pressure is a desirable quality. Propellants having relatively 
high vapor pressures can overpressurize the missile tankage if the temper- 
ature becomes too high. A low vapor pressure is also important because it 
reduces the possibility of pump cavitation wh i ch results when gas bubbles 
are formed at the inlet of a high speed pump. 



• A low freezing poing is required if launches are anticipated during cold 
periods. Even more important is the extremely low temperature encountered 
in space. The propellant must not freeze or slush or it will block small 
openings and valves. 

• Low viscosity propellants simplify pumping problems. It allows better 
injection and mixing of the propellants and provides better combustion and, 
therefore, better specific impulse. Low viscosity propellants also simplify 
pump, thrust chamber and injector designs. 

3.3 Chemical Properties Desired in Liquid Propellants 

There are many chemical properties desirable in liquid propellants. A discussion 

of these properties follows. 


• High Heat of Combustion - Highly reactive propellant combinations which 
produce a high heat of combustion are desirable since these combinations 
generally provide high specific impulse. Many highly reactive propellants 
have been synthesized; however, because of cost and availability, they are 
not ready for use in large booster systems. 

• Low Molecular Weight of Exhaust Products - High specific impulses are 
achieved with propellants having very low molecular weight exhaust products. 
This is the reason LH^ is used in interplanetary spacecraft; it provides 
the high impulse required of the upper stage motors. 

• Chemical Stability - Chemical stability is desirable if propellants are to 
be transported over long distances, stored for long periods at the launch 
area, or used in very long space flights which require restarts. 

• Low Ignition Delay - In very large, high thrust rocket systems, propellant 
flow rates may be of the order of thousands of pounds per second. Ignition 
delays of any significant magnitude, during engine start and during the 
inject on process, can result in instability and destruction of the engine. 
The ignition delay time, therefore, must be minimized. In some cases this 
can be done by slightly preheating the propellants or by using chemical 
sensitizing agents. 


Non-Corrosiveness - Propellants should be compatible with the materials in 
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oxidizers in current use have corrosive qualities. This problem is circum- 
vented by choosing compatible materials or by special treatment of surfaces 
which will be exposed to corrosion. 


3 • 4 Operational Requirements of Liquid Propellants 

In some cases the choice of a liquid propellant is affected by the operational 
requirements imposed by launch facilities or program objectives. These operational 
requirements apply more to military ballistic missiles than space booster systems. 
Some factors which must be considered are: 
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• Stability - Propellants should be stable over long storage periods. 

• Sensitivity - Propellants should be insensitive to mechanical shock. 

• Toxicity - Toxicity should be minimized if boosters containing large 
amounts of propellants are launched near inhabited areas. 

• Reactivity - Propellants should not react with materials used in storage 
tanks, missile tanks, or motor components. 

Some military missions require that the reaction products be difficult to 
detect visually and that they have a minimum attenuation of RF signals. 

4.0 LIQUID PROPELLANT SYSTEMS 

Various propellant systems have evolved and have been developed for different 
applications. A brief discussion of these systems follows: 

4. 1 Monoprope 1 1 ants 

A monopropellant is normally a stable liquid urder ambient pressures and temper- 
atures. When suitably initiated, it decompose; to produce hot gases without the 
addition of either a fuel or oxidizer. Some e>amples are hydrogen peroxide, 
ethylene oxide, hydrazine, and n i tromethane . 

These propellants can be decomposed by several techniques. Most monopropellants 
will react simply by elevating their temperature to the decomposition point or 
by introducing catalysts. Hydrogen peroxide, for example, reacts vigorously 
when in contact with silver or potassium permanganate. The V- 2 and Redstone 
turbo-pumps were driven by hot gases produced by passing hydrogen peroxide 
through a catalyst bed of potassium permanganate. 

The specific impulse of monopropellants is relatively low when compared with 
other liquid propellant systems. They a re used primarily in gas generators, 
vector control devices, and retro systems. Their prime attribute is simplicity. 

4. 2 Bi propel 1 ants 

Bi propel lants are the most common systems used in present day rockets. They con- 
sist of a liquid oxidizer and a liquid fuel which are injected independently 
into the combustion chamber. These systems are relatively complex since they 
require two different propellant tanks, turbo-pumps, and pressurization systems. 
However, they do produce the highest specific impulses obtainable with conven- 
tional propellant systems. 
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In the future, it is highly probable that liquid hydrogen and liquid fluorine 
will be used. This combination offers the highest performance potential of 
presently known chemical propellants. The handling and materials problems for 
great quantities of these propellants must be overcome before they can be used 
for space operations. 

4.3 Hybrid Propellant Combinations 

Hybrid propellant combinations consist of one solid and one liquid propellant. 

The general configuration of a hybrid propellant rocket consists of a solid 
grain having an internal passage through which liquid propellant is injected. 

The liquid reacts with the solid on contact and creates the high pressure and 
high temperature gases required for propulsion. Considerable research is pres- 
ently in progress to develop hybrid systems because they are simple, require 
pumping only one liquid, and can be repetitivel/ turned on and off. The problem 
which must be overcome is inadvertent breakup of a solid propellant causing it 
to be expelled from the nozzle, thereby lowering the total impulse of the system. 
Another obstacle which must be overcome is the development of a proper injection 
and mixing system which will maintain a relatively constant chamber pressure 
and oxidizer to fuel burning ratio. 

4.4 Thixotropic Propellants 

It has been recognized for some time that marked increases in impulse can be 
achieved by adding finely ground metals or hydrides to liquid propellants. The 
major problem encountered has been in keeping these fine metallic particles 
suspended so that the mixture is homogenous. Recently, methods have been devised 
for suspending solids in liquids by making them gelatinous - very much like 
"Jello". These mixtures, when in a gel form, are called thixotropic. Under 
ordinary conditions the finely ground metals are added to the fuel, the fuel 
is mixed thoroughly and, when agitation has ceased, the propellant turns into 
a gel which can be stored for considerable time. When the gel is submitted to 
a shear force it immediately becomes a liquid. Large boosters of the future may 
very well utilize thixotropic propellants containing fine suspensions of aluminum, 
beryllium, lithium, or their hydrides. 
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engine start, the pyrophoric is injected into the thrust chamber with the fuel, 
and on contact with the oxygen, it ignites. Ignition by this technique is 
generally smooth. Pyrophoric compounds must be handled carefully since a leak 
or spill will produce a fire if air or any oxidizer is present. 

5.3 Pyrotechnic Devices 


These igniters consist of a small solid propellant charge which produces a high 
temperature flame. A small squib is usually initiated by an electrical bridge- 
wire which in turn ignites a larger solid initiator. Various designs are used 
in current rocket systems; for example, the Titan I incorporated a series of 
initiators arranged in a Christmas tree configuration. This arrangement increased 
the ignition reliability and assured a large amount of flame during the start 
phase. 

Another pyrotechnic device, used mostly in large solid motors, is the "pyrogen" 
igniter. This device is similar to a small solid propellant rocket. Holes in 
its case direct jets of flame into the rocket's main motor chamber. This in- 
tense flame quickly ignites all exposed uninhibited surface of the propellant 
grain. Pyrogen igniters are reliable, provide reproducible starts and are 
easily installed or replaced. 


5.^ Ignition by Electrical Energy 


Electr ical energy may be used to ignite small motors directly or larger motors 
indi rectly. 

Small rocket motors can be successfully ignited by electrical energy using 
glow plugs, hot wires, arcs and exploding bridgewires. 


Large rocket motors require a tremendous amount of energy to provide reliable 
ignition; therefore, electrical devices are used to initiate small squibs which 
in turn ignite larger initiators. 

5.5 Hyperqolic Ignition 


Hypergolic propellants ignite spontaneously when mixed together at ambient 
pressure and temperature. Some well known rockets using hypergolic propellants 
are Vanguard (Stage II), Titan II, and Agena. This type of ignition is desir- 
able as it eliminates the need for igniters and electrical devices (other than 
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valve solenoids). Hypergolic propellants provide a reliable means for repeated 
starts in space and lunar return missions. 

6.0 HAZARDS ASSOCIATED V/ITH LIQUID PROPELLANTS 

There are many and varied hazards associated with liquid propellants. Some of 
these are discussed below. 

6. 1 Cryogenic Hazards 

• Cryogens, being extremely cold, can damage skin tissue and result in 
serious permanent injury. 

• Very large spills have been known to weaken the structural materials 
normally found on launch complexes. 

© Cryogens must not be trapped in closed systems which do not contain a 
suitable venting capability. The gases formed can generate sufficient 
pressure to produce an explosion. A relief valve or burst disc (or both) 
is mandatory to prevent overpressures. 

• Another hazard which may be encountered with cryogens, such as liquid 
helium and hydrogen, is that air will condense and freeze in these liquids 
if allowed in the system, thereby becoming enriched with oxygen. If the 
containers are not free of hydrocarbons, c serious fire hazard and pos- 
sible explosion can occur. 

• Rapid pumping of cryogens into warm storage or missile tanks can result 
in sudden flash-off and the evolution of tremendous quantities of gas 
which could result in rupture of the system. 

6 . 2 Contamination Hazards 

Numerous fires and small explosions have been reported which were the result of 
unclean liquid oxygen systems. Oil films left in the system as a result of 
improper degreasing techniques or from fingerprints can react with liquid oxygen 
under proper conditions. Adequate quality control and frequent system sampling 
will help eliminate this problem. 

In some instances, nitrogen tetroxide systems may require detanking and neutral i 
zation of residual propellants. Recent investigations indicate that some of the 
cleaning solutions used in these tanks reacted with residual nitrogen tetroxide 
and formed explosive products. By following recommended procedures and by using 
authorized neutralizing agents, accidents of this nature can be eliminated. 
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Hydrogen peroxide, although a monopropel 1 ant , can be handled safely if proper 
precautions are taken. Since hydrogen peroxide reacts readily in the presence 
of catalytic agents, it must be stored in containers which have been passi- 
vated. This passivation process involves treating the surface of containers 
or piping, either with chemicals or by exposing them to reduced concentrations 
of hydrogen peroxide. Unless this is done, concentrated hydrogen peroxide 
will react slowly, bubbles of gas and heat will be evolved, thereby causing 
a buildup in pressure and an increase in the reaction rate. If the reaction 
becomes too rapid, a violent explosion may result. 

6 . 3 Static Electricity Problems 

Static electricity has been the cause of numerous fires and explosions. Fluids, 
either conductive or non-conduct i ve , will build up a static potential if sprayed 
or allowed to drop through air or vapors. If the pumping systems are not thor- 
oughly bonded to a common ground, a spark can occur. Several cases have been 
reported where gasoline and similar substances were ignited by static discharge 
during a pumping process. It is recommended that, if possible, liquids be 
pumped into the bottom of a tank or, if this is not possible, from the top 
through a long stand pipe with an opening which is below liquid level. The wide 
flammability range and low ignition energy recuired to initiate combustion of 
hydrogen requires extra precautions. 

6.4 Spills 

Several accidents have been reported which are believed to have been caused by 
spilling liquid oxygen on the ground. One of these accidents occurred during 
a liquid oxygen transfer from a truck to a storage tank. A steady leak of 
liquid oxygen apparently penetrated the surface of a macadam road. Subsequently, 
a technician dropped a wrench on the spill area and an explosion occurred 
resulting in serious injury and extensive property damage. 

In working with hypergolic propellants, care must be exercised to prevent leaks. 
Fires have been reported which resulted from spillage of UDMM which penetrated 
the surface of the paint of an engine test facility. Although the area of 
spillage was cleaned, a later spill of a small amount of oxidizer caused a fire. 
Many booster engine systems contain a large number of transducers and propellant 
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lines which are wrapped with reflective foil to protect them from radiation 
temperatures. The accumulation of propellants under these wrappings must be 
avoided. 

Hypergolic propellants present serious fire hazards if spills are not neutral- 
ized. Wherever possible, the fuel and oxidizer systems must be separated and 
care must be exercised to eliminate the possibility of using a fuel system 
component in an oxidizer system. This is best achieved by using different 
fittings or line sizes to differentiate between oxidizer and fuel system 
component . 

6.5 Adiabatic Compression and Ignition 

Ignition of propellants has occurred as a result of adiabatic compression of 
gaseous bubbles in a liquid system. An adiabatic process is defined as one in 
which no heat enters or leaves a system. If a gas bubble is compressed very 
rapidly, very high temperatures can be attained in the compressed gas. The 
theoretical temperature which may be attained by adiabatic compression is 
shown below. 

THEORETICAL TEMPERATURE ATTAINED 
BY ADIABATIC COMPRESSION 



Figure 5~1 


If a bubble is instantaneously compressed to about 2000 psia (which is pos- 
sible in high velocity pumping systems), a temperature of almost 900°C. 
(1650°F.) can be attained. If a contaminant is present or if the liquid is 
a monopropellant, a small reaction is possible which can trigger a more 
serious monopropellant explosion. Adiabatic compression problems can be 
avoided by incorporating pressure accumulators, or by closing system valves 
slowly to prevent "water-hammer" effects. 

7.0 CONCLUSIONS 

In conclusion, the most serious safety hazard involved in dealing with liquid 
propellants is not the propellants themselves but the personnel handling them. 
Personnel working with liquid propellants, in many cases, become disdainful 
of the inherent hazards. Initial training must be followed by a continuous 
training program which incorporates demonstrations, qualification tests, 
lectures, and pertinent up-to-date information on accident prevention 
techn i ques . 

A follow-up tra : ning program of this type will serve two purposes: 

1. It will prevent the occurrence of accidents which normally result from 
boredom. 

2. It will bring personnel up-to-date on accidents which have occurred, 
will increase their knowledge of propellant hazards and will train them 
in the hazards anticipated with future propellants. 
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Lecture Number Five 

"SPECIAL PROBLEMS OF LIQUID PROPELLANTS" 

Part II 

Mr. G. N. Woodruff 

1.0 TOXIC PROPELLANTS 

Toxicity is one of the major problems associated with certain liquid propellants. 
Typical of toxic propellants are nitrogen tetroxide Unsymmetr i cal 

dimethylhydrazine (UDMH) , fluorine, hydrazine, monomethyl hydraz i ne (MMH), and 
chlorine trifluoride (CTF). 

2.0 DEFINING TOXIC HAZARD LIMITS 

"Toxic" means that inhalation of enough of the vapor, or skin contact with the 
liquid, will be injurious to health in some manner. The word "toxic" implies to 
the layman rapid injury or death, however, this is not the same meaning that 
industrial hygienists apply to the word. "Toxic" does not define a hazard since 
a great many things with which we come in daily contact are toxic to some degree. 
To define the toxic hazard associated with a propellant, or for that matter, 
any material, some numerical value is required. There are several numerical 
values which apply to work in the missile launching and space fields; the most 
important of these are the Maximum A1 lowable Concentration and the Emergency 
Tolerance Limit. 

2 . 1 The Maximum Allowable Concentration (MAC) 

The limits of toxicity which have been accurately established are the lower 
limits; that is, the concentrations which present no danger to humans. The 
working lower limit is called the Maximum Allowable Concentration (MAC). The 
MAC represents a figure for vapor or dust concentrations to which a human can 
be exposed for 8 hours a day, 5 days a week, for all of his working life without 
injury to his health. It is important to note that this is a weighted average 
concentration; that is, that exposures to slightly larger concentrations, followed 
by periods of no exposure or lesser exposures will presumably do no harm.* 
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Figure 5-2. MAXIMUM ALLOWABLE CONCENTRATION (MAC) 
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The MAC did not grow out of the rocket industry and the handling of liquid 
propellants. It is a figure which originated in the chemical process indus- 
tries, where workers are exposed to chemical fumes and vapor on a daily basis. 
MAC's are commonly expressed in terms of parts per million of vapor in air 
(ppm) , or as milligrams of material per cubic meter of air (mg/m^). Figure 5-2 
shows some of the MAC values for propellants which may be used on the Apollo 
program. 

To get some idea as to the relative toxicity of these propellants, one can 
compare their MAC values with a number of insecticides commonly used around 
the home; e.g., pyrethrum, lindane and DDT have MAC limits equivalent to those 
of the propellants. Even moth crystals are toxic and have an MAC of about 
400 ppm. Just as in the home, where insecticides are not used all day every day, 
people engaged in launch operations are not usually exposed to vapor concen- 
trations on a daily basis. A launch vehicle arrives, is checked out, and 
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finally propellants are loaded on board. The actual time that personnel, other 
than those in the propellant storage areas, may be exposed to toxic vapors is 
only a few days per month. However, a launch operation presents the risk of 
releasing a large quantity of propellant at one time, and creates a situation 
where personnel may be exposed to high concentrations for very short periods 
of time. 

2.2 Emergency Tolerance Limit (ETL) 

Hygienists have established some numbers which are guidelines for once-in-a- 
while exposure and are to be used only in the case of an emergency. These 
values, the Emergency Tolerance Limits, are emergency tolerances and are not 
recommended by anyone as planned working limits. The Emergency Tolerance Limit 
is a time-weighted number which establishes exposure limits for varying con- 
centrations of vapor, based on the time of exposure to the vapor. Figure 5~3 
shows the ETL's established for selected missile propellants. 

Figure 5“3. EMERGENCY TOLERAIICE LIMITS 
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^American Council of Government Industrial Hygienists 
VwVAme r i ca n Industrial Hygiene Association 

Some discussion of other parameters which might be used to define toxicity may 
be in order. The MAC and ETL figures are those which the body can withstand 
without injury, either temporary or permanent. It is very difficult to obtain 
much data on exactly what the body can tolerate and, of course, impossible to 
obtain lethal limits, except by extrapolating data from laboratory tests on 
animals. Extrapolated lethal figures are available, but have no application 
to daily operat i on. 
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3.0 HAZARD SOURCES 

A toxic problem is caused by vapor (or fume, etc) or liquid coming into contact 
with a human. In theory, toxic propellants are handled in closed systems and 
no such contact is possible; however, experience belies that theory. 

When using liquid propellants there are three sources of toxic hazards pos- 
sible in the launch environment: the leak, the spill, and the disaster. 

•. The leak is the smallest of these and also the most prevalent. A 
study of history of the Titan 11 and other missiles using storable 
propellants, shows that leaks occur in unattended systems. Leaks 
■primarily originate at gaskets and seals, or in castings which may 
have porous imperfections. Generally, leaks present no major toxic 
hazard; the quantities involved are comparatively small. 

• The spill represents the most serious source of a toxic hazard. 

Spills, in general, do not occur unless people are around. Discon- 
nects, fittings, and propellant loading operations are sources of 
spills which may involve quantities of propellants, from one gallon 
up to several hundred gallons. Spills may present a major toxic 
hazard or a major thermal hazard, or both. Spills are the problems 
to be considered most seriously. 

• A disaster may cause a major toxic hazard. Launch vehicles have 
been known to explode or impact on the Cape. In the past these were 
LOX-RPI fueled vehicles which presented only fire and explosion haz- 
ards. Currently the Titan II and Apollo systems carry storables 
and, in addition to the fire hazard, a toxic hazard is present. The 
exact location of the hazard is impossible to predict since the 
problem can occur either on the launch stand or in the early portions 
of flight. 

4.0 MINIMIZATION AND CONTROL OF TOXIC HAZARDS 

4. 1 Minimization of Toxic Hazards 

Once the sources of the hazards are known, methods for minimizing the hazards 
may be established. There are four effective methods employed to minimize 
toxic hazards: design, procedures, education, and protection. 

• The design of the system is the first step; it should be designed as 
failsafe as possible. Wherever feasible, components should be used 
that have been proven in service. Fittings, seals, and joints should 
be kept to a minimum in all space vehicle systems. 

• Procedures and education are the two most important factors in con- 
trolling toxic hazards. These two methods will be considered simulta- 
neously because of their interdependency. The following incident is 
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related as an example of what can happen when procedures are not followed 
and personnel are not properly educated. A procedure was not followed and 
two valves were not closed. As a result, several hundred gallons of nitro- 
gen tetroxide backed into a vent system. A safety procedure was not avail- 
able to handle this problem. In an attempt to cope with the situation, 
water was dumped on the spill. (Water and nitrogen tetroxide mix to form 
nitric acid, but in the mixing, nitrogen tetroxide vapors are evolved.) 
Eventually there were two problems: a dense cloud of nitrogen tetroxide 

vapor and a pool of nitric acid. 

Following procedures would have prevented this spill and proper education 
would have minimized the hazard. Procedures and education offer the most 
promising methods for eliminating and for reducing toxic hazards. 

• Protection is the fourth method of combating a toxic hazard. Protection 
is provided for anyone working on potentially hazardous systems and for 
those in the immediate area. Protection is actually a combination of 
minimizing and controlling; once a hazard is present, protection can only 
minimize the personal danger to the people working in the area. Procedures 
and education will indicate the requirement for protection which is effec- 
tive only in the event of an immediate danger. 

4.2 Control 

If a hazard occurs it may be suppressed and/or neutralized. Suppression is a 
quick step which does not eliminate the hazard, but reduces it to the point 
where people can come into the area and make necessary corrections. As an 
example, nitrogen tetroxide vapors from spills may be suppressed with a fine 
spray of water (NOT A DELUGE). However, the net result will be nitric acid 
which must be neutralized. 

• There are three effective methods for the suppression of toxic propellant 

spills: a) A fine water spray will minimize the rate of vaporization 

and removes previously vaporized propellant from the atmosphere, b) Freez- 
ing will solidify the propellant and prevent any further vaporization, 
c) Foams may be applied and will prevent further vaporization while simul- 
taneously diluting the propellant as the foam deteriorates. 

• There is only one method of neutralization: a chemical reaction. The 

specific chemical neutralization is different for each propellant. In 
general, propellants must be diluted before they can be neutralized so 
that suppression must precede neutralization. 
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Lecture Number Six 

"PROCEDURES - THE CO NERSTONE OF SAFETY" 
Part I 

Mr. J. Larks 

(Written by G. J. Bryan and J. Larks) 






1.0 INTRODUCTION 

Good procedures are the cornerstone of any effective safety program. They are 
essentially the tactics and strategy of the battleline. They are vital for safe 
operations as well as for meeting engineering requirements. If a program is 
being performed with good procedures, this is good evidence that it is under 
control and vice versa. Control of procedures is a vital element in the control 
of a p rog ram . 

What is a procedure? It is a written step-by-step set of clear directions which 
incorporates safety aspects and effectively performs an operation. In addition, 
it is designed for quality control buy-off and as a permanent record. 

Only reasonable intelligence should be assumed for the individual performing the 
job. Substitution of highly educated engineers for technicians is no excuse for 
poor or missing procedures. Good indoctrination and training are required. These 
are a complement to good procedures - not a substitute. In theory, a good pro- 
cedure could probably be performed without special training. (This would, of 
course, not be allowed.) 

Why are we putting so much emphasis on procedures? There are four major reasons: 

1. Good procedures are vitally important with regard to safety as well 
as engineering requirements. 

2. Experience has shown that the development and use of good procedures 
requires heavy emphasis at all levels of management and operation. 

3. Experience also indicates that few individuals fully appreciate the 
systematic approach and thoroughness of detail required to prepare 
and use procedures. 

4. Items 2 and 3 are partially due to widespread psychological antagonism 
to the regimentation and tedium involved in the thorough preparation 
and use of procedures. 
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In many respects, procedures should be considered as a piece of equipment 
which must be designed, prepared, delivered on date, and used for its intended 
purpose. And a procedure, like a piece of equipment, must be modified 
(revised) when necessary to do its job. 

2.0 PREPARATION, REVIEW, AND APPROVAL OF PROCEDURES 

2.1 J_d entification and Naming 

The first step in preparing a procedure is to determine the units of operation 
which require coverage. This selection of unit operations should have been 
made during early R & D phases for the more significant procedures. Otherwise, 
how are the right test equipment, the right facilities, and correctly trained 
men to be available on schedule? These are all-important from the safety 
viewpoint, as well as the engineering viewpoint. In many cases, it will be 
found that there are many procedures which have not been given early recog- 
nition, because they are not closely tied to long lead times. The respons- 
ibility and authority, to identify and assemble the names of all unit operations 
needed, must be delegated early in the definition phase. 

2.2 Assignment of Responsibility 

Once an operation has been isolated, it must be assigned by management to 
someone for development of a procedure. Due dates for completed (reviewed 
and revised) procedures must also be assigned. These dates must be maintained 
in much the same manner that hardware arrival dates are maintained. 

Individual procedures will normally be prepared to cover a logical unit of work. 
These unit procedures must then be tied together in a logical and safe sequence. 
This compilation needs the same thorough approach required for preparing, 
reviewing, approving, using, and changing of unit procedures. Logical groups 
of procedures must be designated, and the responsibility for unifying them 
must also be assigned. 

The initial preparation of a procedure will generally be assigned to an indi- 
vidual who will directly supervise an operation. 
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2.3 Prepa rat i on 

A procedure is a working document. Its language should be concise, clear, , 

simple, direct, and unambiguous. Illustrations should be liberally used. 
Clear-cut criteria of acceptance and rejection should be included. In pre- 
paring a procedure we need to examine it to ascertain that it contains: 

1. A statement of the purpose of the operation. 

2. A correct list of all equipment, tools, and drawings needed. 

3. Initial status of item on which work is to be performed. 

4. Detailed steps to be performed. 

5. Provision for recording data. 

6. Provision for recording that steps have been correctly performed. 

7. Provision for recording problems uncovered and bringing such 
problems to the attention of the correct people to resolve them. 

(This may be in the form of reference to an SOP.) 

8. Final status and disposition of items on which work has been per- 
formed. 

9. Detailed safety comments and procedural steps in the introductory 
portion and in the body of the procedure. These must be in the 
most effective location and sequence. 

The person writing a procedure must be thoroughly familiar with all of the 
equipment that is to be used, both test and flight equipment. He should also 
be familiar with the environment in which the operation is to be performed, 
the building and area, along with special features and other nearby operations 
(active or inactive). 

The procedure writer should, of course, be familiar with earlier procedures. 

Many elementary procedures must be worked out early in R & D in order to develop, 
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procure, or locate adequate and available test equipment, special tests and 
cables, facilities, and flight equipment. These procedures are never satis- 
factory as actual procedures. Many procedures are often not worked out at all 
in early R £• D; for instance, visual receiving and inspection, and maintenance 
and checkout procedures for test equipment. In many cases, fairly detailed 
procedures are developed at home plants during checkout for static firing or 
other tests. These are usually very helpful, but generally require signifi- 
cant changes before being used at Cape Kennedy. 

Safety publications covering SOP's and general safety information should be 
available to the procedure writer. Some of these, such as standard building or 
area precautions, may be incorporated with little change. Others, such as 
grounding, shielding, no voltage checks, etc., will require thoughtful attention 
to see that they are appropriately incorporated along with other engineering 
step-wi se detai 1 . 

The writer should have a safety checklist available, preferably as part of a 
safety publicatior. A few simple questions will often show weak points: Is 

special clothing, special building design, or other special safety equipment 
needed? Have all grounding details, clothing details, equipment details, weather 
restrictions, necessary sequences, etc., been carefully and clearly stated? Is 
there some special hazard present? What can be done to reduce that hazard? 

Should tight restr ictions be maintained on personnel access? Is remote oper- 
ation necessary? 

To uncover all ordnance or propellant problems, it is desirable to list all 
ordnance or propellant items present or nearby. Each item should then be exam- 
ined versus the planned operation to see whether there is a safety problem. 

This process will' often uncover unsuspected problems from operations not orig- 
inally considered to have ordnance or propellant safety implications. 

A walk-through visualization should be made after the first rough draft. This 
means that the operation would not actually be performed, but the writer would 
examine equipment, switches, safety equipment, facilities, etc., as they were 
called for in his procedure. In many cases, when inert equipment is involved, 
he may then informally have the procedure performed by a technician. This should 
only be done with the approval of his supervisor and the reviewer(s) for his 
procedure . 
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2 .4 Fog Index 


To evaluate the clarity and brevity of written procedures, we can make use of a 
yardstick known as the "Fog Index." This is a tool to gauge the readability of 
material. The Fog Index corresponds roughly with the number of years of school 
ing a person would require to read a passage with ease and understanding. The 
steps for the calculation are: 


' A vv > v> 




FOG INDEX 



(W avg ♦ W 3 eyl ) x 0.4 = FI 
Where: 

W »vg = average number of words per sentence 
3 syl = percentage of three or more syllable words 


FI 

Bible 7 

Atlantic 12 

Scientific American 13 


Figure 6-1 

Find the average number of words per sentence using a sample of at 

least 100 words (W ) . 

avg' 

Count the number of words of three syllables or more per 100 words 

(W 3sy| %). 


• Add the two factors together and multiply by 0.4. 


• Do not count words which 
or "eo" or "es", such as 
bination of simple words 


become polysyllables (3 or more) 


I ca tcu 


) 


( 


, such as bookkeeper. 


by the addition 
or are a com - 


A Fog Index for a procedure should not exceed twelve and should generally be 
in the 8 to 10 bracket. 



FOG INDEX EXAMPLE 


Safety Notice 

At a recent meeting of the 
Safety Committee, it was 
reported that in some locations 
water is left running, equip- 
ment is operating, and other 
conditions exist where no 
special instructions have been 
left for Watchmen . 

Will you please warn the 
members of your staff to post 
a sign on any equipment that is to 
be kept operating during the night, 
or if water is to keep flowing, etc. 
In the absence of such instructions, 
it will be the duty of the Watchmen 
to disconnect electrical equipment, 
turn off any water they find running, 
or turn off any kind of running 
machinery. V/hen it is necessary 
to have items operating during 
the night, in addition to the note 
stating "Do Not Turn Off", the 
name and telephone number of 
the person responsible should be 
noted in order that the V/atchman 
may contact that person in the 
event something seems to go 
wrong during the night, such as 
overheating, etc. Your cooperation 
will be greatly appreciated. 

FOG INDEX - 17 plus 

Total Words - 164 
Total Polysyllables - 20 
W -35-33-33-57-6: 33 . 

a V 9 

W 3 syl- 


Safety Not i ce 

Neglect of night instructions 
for watchmen was reported at 
a recent Safety Committee meet- 
i ng . 

Will you please warn your 
staff again to post a sign on 
equipment that is to run at 
night or have water f lowing. 

When such signs are lacking 
watchmen are instructed to 
turn off water or running 
machinery. When apparatus 
must operate at night be sure 
to mark with a "Do Not Turn 
Off" sign and add name and 
phone number of person in 
charge. The watchman will 
call that person if something 
seems to go wrong during the 
night. Thank you for your 
he :p . 


FOG INDEX - 8 

Total Words - 99 

Total Polysyllables - 4 

W av g-^- 2 3- , 5- 2 7- , 5-5 : J6 


Figure 6-2 


2 .5 Review and Approval 

After the initial output is ready, the originator needs access to a reviewing 
authority or authorities who can cover all technical reports of the procedure 
(including safety) . 
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The initial contact with the reviewing authority or authorities will often result 
in considerable dismay to the procedure writer, particularly during initial 
phases of a new program when the experience factor is low. When this occurs, 
the reviewer must often perform a training role. Since the reviewer will usually 
be a busy man with many other duties, he cannot afford to succumb to the temp- 
tation to do the job himself. This training will later result in his review 
requiring no more than a reasonable amount of time. 

In larger organizations, it is advantageous to have a procedure handbook and a 
short procedure writing course available. Often "tech writer" assistance is 
available. Where such assistance is available, the reviewer has the right to 
expect that the procedure writer make use of it. Unfortunately, even in a large 
organization, the initial product the reviewer receives may be in "sad shape." 
Sometimes earnest conversations, with the procedure training head or his superior, 
will be more fruitful than the training of individuals. 

The reviewer must always keep in mind that most people respond better to tact 
than they do to temper, but firmness is nearly always a requisite. After all, 
the reviewer has his reputation at stake for the technical soundness of a pro- 
cedure which he approves. The high level of experience and competence needed, 
for final review of ordnance and propulsion procedures, was in the first lecture. 

ft 

The reviewer will normally require his own presence during the first formal run. 
This should be done with inert ordnance and propulsion systems at the beginning 
of a program. Often this is also desirable later in a program. His attendance 
will normally be required during the first live run. 

Review and approval may sometimes be combined in one person. There should be a 
method of sign-off, so that review and acceptance of all necessary parties must 
be signified in writing, prior to use of a procedure. 

3.0 REVISION OF PROCEDURES 

The most important requirement for revisions is that they be as carefully pre- 
pared and reviewed as the original procedure. Paperwork should normally be 
designed, so that page revision is possible without the necessity of rewriting 
an entire procedure. Changes in procedures should be highlighted in some manner, 
so that the reviewer has to review only the changes, and not the entire procedure, 
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or even the entire page. High-level review requires care not to overuse the 
reviewer's time. 

Good procedures should require few changes, but a definite and essential route 
for effective revision must be established. Format and literary matters should 
be incorporated in the original; later changes for such reasons should be dis- 
couraged. It must be realized that a change of format requires detailed word- 
by-word study of the writer and of the reviewer. Seemingly slight changes in 
wording, or in sequence, can have serious safety and/or other engineering 
consequences. 

There must be a definite method established, whereby the appropriately revised 
procedure is the procedure used, not a superseded one, and not one designed for 
new equipment which is not yet being utilized. 

REVISION OF PROCEDURES 

• Careful preparation and review 

• Pagewise revision 

• Highlight the changes 

• Definite and effective approval route 

• Insure correct procedure usage 

Figure 6- 3 

4.0 ENFORCEMENT OF PROCEDURES 

Rigid enforcement of working exactly by procedures and doing all work by pro- 
cedures, is critical for safe operations as well as for engineering reasons. 

This requires that procedures must be proper and workable. If they are not, 
they should be revised, not ignored. If time is of the essence, then qualified 
people can be brought to the operation to make, review, and approve revisions 
on the spot. 

Intense indoctrination and rigid enforcement is normally needed to have complete 
compliance with procedures. Such compliance is critical and must be obtained. 
Active management backing is necessary at all levels. 
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A few questions are of particular importance for ordnance and propellant oper- 
ations. Have all personnel performing these procedures been properly trained, 
indoctrinated, and certified? Do technicians and their supervisors know who must 
approve changes in procedures? Have personnel, working in the vicinity of 
ordnance devices and propellants, been trained and indoctrinated, so that they 
will not blunder into an ordnance problem? 

5.0 CONCLUSIONS 

If all operations are performed according to well prepared and adequate pro- 
cedures, safe and effective operations will result. Although basically simple 
to do, this occurs only if management insists on their organization preparing 
and using good procedures early in a program; and continuously monitors that 
this situation is maintained throughout the program. Procedures are indeed the 
cornerstone of any safe, effective test program. 
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Lecture Number Six 

"STATIC ELECTRICITY AND LIGHTNING HAZARDS" 

Part II 

Dr . G . J . B ryan 


1.0 SQ.U IB AND DETONATOR SENSITIVITY 

The voltages required to cause detonators and squibs to fire are very small 
Most of those used at Cape Kennedy meet the"l amp no-f i rd' spec i f i cat ion and 
their resistances range from 0.04 to 1.0 ohm. This means that 1 ampere is 
exceeded when 0.04 to 1.0 volts are applied to these respective resistors. 


pm 



Figure 6-4 


The amount of energy required to initiate either a squib or a detonator is very 
small when it is applied as a sharp spike. Exaggerated energy levels of 400,000 
ergs magnitude are sometimes quoted, when this figure may actually be referring 
to a type of static electricity test in which a 5000 ohm resistor is in series. 
In this case nearly all of trie energy goes into the series resistor. Values of 
200 to 20,000 ergs are in the correct range, with the lower figure being more 
typical of detonators and the higher more typical of squibs. Unless reliable 
data is available proving higher values, 200 ergs should be used. Such values 
can be obtained, using square wave generators combined with a carefully set-up 
high speed osc i 1 1 oscop i c recording. Many initiators also exhibit greater sensi- 
tivity is being measured, rather than the sensitivity due to bridge wire heating 
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Figure 6-5 

Do not make the mistake of figuring minimum initiating energies from minimum 
firing currents! The exact opposite condition is more nearly applicable. Mini- 
mum energy is required when very little of the energy is conducted from the wire 
and thus most of it is effective in heating the wire. This only occurs under 
very high rates of energy application in which initiation occurs in less than 
one mi 1 1 i second . 

For static electricity and lightning, the minimum initiating energy is generally 
the principle sensitivity yardstick. This may also be a good index for RF sensi- 
tivity, particularly for pulsed RF. The minimum voltage required for initiation 
is often the controlling sensitivity index for stray currents and sometimes for 

RF. 

2.0 STATIC ELECTRICITY 

Accidental initiation of squibs and detonators and of vapors and dusts by static 
electricity is considerably more frequent than is generally recognized. Fatal 
accidents are generally well publicized. Where injury is slight or nonexistent, 
very little publicity results. 

The most positive protection of ordnance against static electricity is to have 
the detonator in a safe-and-arm device. This should not only protect the sensi- 
tive element, but also prevent propagation of ignition or detonation and be 



self-contained in case the squib or detonator alone is somehow set off. This 
is definitely the preferred method of protection. 

When squibs or detonators are not protected with safe-and-arm devices, they 
should at least be electrically shielded and the firing leads should be con- 
nected to that shield through a resistor of the order of a few hundred thousand 
ohms resistance. These should be present when shipped. This will give consider- 
able protection. Any operations involving these devices should be done in a 
thoroughly grounded environment, including nearby personnel. Details of such 
grounding will normally be covered in SOP's. This grounding is somewhat more 
complex than might be immediately apparent, though it is simple in principle. 

Late- i n-countdown installation of such unprotected devices is often requisite. 
Weight penalties from this can often counterbalance any savings in weight obtained 
by not using safe-and-arm device protection. 

Insofar as possible, static accumulating materials should be kept away from unpro- 
tected squibs and detonators. Nonconductors are in general suspect, particularly 
many of the common packaging plastics. There are conducting plastics available 
to cover many applications. Any static accumulators used around unprotected 
squibs, detonators, explosive vapors or dusts are difficult to justify and should 
be specifically provided for if unavoidably present. 

There are various survey meters which can detect the accumulation of static elec- 
tricity. Their use, along with several "wiping cloths" for generating charges, 
can be quite helpful in assessing the static electricity hazards of an area. Non- 
conductors do vary greatly in their ability to act as static accumulators. 

In considering static electricity, the following three functions require attention 

• Generation - Some type of friction or flew is generally involved. This 
may be a person's clothing or shoes brushing against an object, the 
flowing of a liquid, the flow of particles, the flow of suspended parti- 
cles (dust, mists, rain), the action of machinery, the mixing or agitation 
of solvents, or other type motion process. Motion is a part of life and 
work, but careful grounding and selection of contacting material (cotton 
is better than most synthetic clothing) can help reduce generation. 

• Accumulation - The positive or negative charges generated must be accumu- 
lated if a voltage is to be built up. Thorough grounding prevents this. 
Nonconductors are hard to ground, but may be discharged by wiping with a 
grounded conductor. 
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• Discharge - To cause a problem an accumulated charge must discharge. If 
sensitive elements such as squibs, detonators, vapors, or dusts are pro- 
tected so that they are not part of the discharge path, then no problem 
will result. If intentional discharge is provided for, then a problem 
can be prevented. 

3.0 LIGHTNING 

More deaths are caused by lightning in the United States during an average year 
than by tornadoes or hurricanes. According to the National Bureau of Vital 
Statistics, an average of 230 persons a year were killed by lightning from 1946 
to 1955. In Florida, 8.8 deaths per year occur (based on 1955 through 1954, 
inclusive). The figure has been lower in more recent years (possibly due to 
the increasing urbanization). On the basis of population, it appears that a 
person in the United States currently has about a one- i n-a-mi 1 1 ion yearly 
chance of being struck by lightning. This does not give a true picture of the 
odds because rural areas have more fatal strikes and fewer people than urban 
areas. It has been estimated that 90 percent of the cases in which persons 
were fatally struck by lightning occurred in rural areas. That's not the whole 
story either. According to the Lightning Protection Institute, lightning kills 
more than 600 persons annually if persons who die in fires caused by lightning 
are included. An additional 1,500 more are injured and property damage amounting 
to $120 million is done. Where you are and what you do, during a lightning storm, 
can make your chances uncomfortably good for being in or near a lightning strike. 

LIGHTNING SAFETY 
Safe Locations 

• Within building with lightning protection 

• Inside steel-topped automobile 

Unsafe Locations 

• Under tall tree • Open field 

• Water shore » Open water 

• Walking highway • Mountain top 

• Atop bui lding 


Figure 6-6 
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There is much misunderstanding and lack of knowledge about how lightning occurs 
and what a person should do during a storm. Standing under a tree, particu- 
larly if it is isolated and tall, is one of the best ways to be killed by light- 
ning (whether you are touching the tree or not). Standing in the water is inviting 
trouble in two ways: by direct stroke because you are the highest point on a 

flat surface, or through the water from a nearby strike. 

Actually, a steel-topped car is one of the safest places during a lightning 

storm. No instance of a fatality in a car from a strike has even been recorded. 

\ 

One of the worst problems about lightning is that people underestimate it. How 
many times a year would you figure that lightning strikes the land area of the 
United States? If you guessed 29.5 million times you're right (8 strikes per 
square mile). Bach day^rthroughaut the wor Id, an average of 44,000 thunderstorms 
produce about 100 lightning strokes per second. According to Peter E. Viemeister, 
in his excellent work on this subject. The Lightning Book , an average 30,000- 
ampere stroke under 125 million volts may develop 3,750 million kilowatts. This 
is more than the total capacity of all the power plants in the United States. 

But because the duration is short, only about 250 kilowatt-hours are used, worth 
about $7.50. 

The U. S. Weather Bureau has compiled an isokeraunic map of the United States, 
by which it is possible to estimate the average number of thunderstorm days per 
year for any area. Central Florida is tops for the United States with up to 
100 days each year. By contrast, the West Coast has fewer than five days per 
year. (The number of storms per year is 140/5 for Central Florida/West Coast.) 

Some spots receive far more than their fair share of lightning strikes. High 
poi nts 9 reach ing pp from the ground above other nearby objects on the earth's 
surface, take the brunt of lightning attacks. Tall trees, ffioun ta i ntops , flag- 
poles, church spires, barns, and tall buildings are among the leaders. 

The Empire State Building took sixty-eight strokes in three years. This dispels 
the idea that lightning never strikes twice in the same place. The fact is-- 
and it is worth remembering--that lightning more than likely will strike the 
same place twice if it doesn't destroy the thing it hit the first time. It's 
true there are many random strikes that are never repeated, but choice spots, 





whether because they are tall or located in areas with a good conductive ground, 
are hit repeatedly. This explains why rural areas have most lightning fatal- 
ities. Tall buildings in cities take the strikes at their tops and conduct the 
electricity safely into the ground. 

One curiosity of lightning fatalities is that five times as many men are killed 
as women. This undoubtedly reflects the fact that more men than women are out- 
doors at any given time.,and thus have more exposure, but it also mirrors a 
difference in attitude about lightning. Men tend to ignore lightning and go 
right on doing whatever they are at; women, on the other hand, take no shame 
in being afraid of i t, and head for the best protection they can find. 

It is possible to be just plain unlucky, as the tragic case of an Illinois 
farmer illustrates. The Weather Bureau reports that the man's barn was set 
afire by lightning and the conflagration killed all his livestock except two 
horses. A week later lightning struck again, destroying his metal hay shed; 
then a few days later it flicked along a fence and knocked the farmer uncon- 
scious. A month after that he was standing in a neighbor's barn when lightning 
struck him in the chest and killed him but damaged nothing else. 

Lightning may be separated into four broad classes: 

• Cloud-to-Ground and G round-to-C loud - Generally jumps from cloud to ground 
with return stroke from ground to cloud. Wnen building heights exceed 
200 feet, there is a significant probability of earth to cloud strokes. 

For the Empire State Building (1250 feet height) eighty percent are of the 
latter type. 

• Cloud - includes intracloud, intercloud, and cloud to air. 

• Tornado type - interior of tornado is typically an area of continuous and 
high intensity electrical discharge. 

• Ba 1 1 or Bead . 

Only the first and third types will be discussed, but cloud types may sometimes 
cause trouble due to induced ground voltages. Cloud-to-ground lightning is 
essentially a transient DC discharge. It is characterized by a rise time of 
the order of a few microseconds and a general irregular decay over a period of 
perhaps 0.25 seconds. Test records have indicated that: 
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• Seventy percent of the strokes have a peak potential of over 2,000,000 volts. 

• The maximum peak potential sometimes exceeds 20,000,000 volts. 

© Peak currents of 50 percent of the strokes will exceed 13,000 amperes. 

© Peak currents of 10 percent of the stroke will exceed 32,000 amperes and 

maximum currents may exceed 160,000 amperes. 

• Most lightning initiates as a shift of electrons from a cloud to earth. 

Direct impact of a lightning strike on a solid propellant rocket or explosive 
device would have an excellent probability of starting a serious fire at the 
impact point. Except for the impact point, heating by conduction through a 
metal case would often not cause a problem, but should be studied on an indi- 
vidual case basis. The possibility of inducing dangerous voltages into a squib 
or detonator is significantly high when the squib or detonator is not in a 
safe-and-arm device. Great care must be taken to protect such squibs and 
detonators, particularly when they are installed in motors or firing trains. 
Buildings containing such devices might well be equipped with a separate ele- 
vated "cone of protection" type of lightning p rotect i on, as well as being pro- 
viced with good building structural grounding. 



Figure 6-7. CONE OF PROTECTION 

Lightning protection can be most simply considered from the zone of protection 
approach. A well grounded, pointed, upright conductor will protect the zone 
included by a cone terminating at its point and with a base equal in radius to 
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Where tall steel towers and steel-framed buildings exist at Cape Kennedy, they 
give excellent protection from direct lightning strikes, provided they are well 
grounded. They will also probably be struck fairly frequently. There must thus 
be careful attention given to the protection of ordnance devices which might 
create a haza rd, shou 1 d they be initiated by induced currents or by currents 
resulting from arc-over. 

Careful studies of tornadoes have shown that they are very intense electrical 
storms as well as windstorms. This electrical activity appears to be of a con- 
tinuous type (more like a massive corona discharge). Since tornadoes are frequent 
in this area, this electrical characteristic should be kept in mind when assessing 
their possible damage to a rocket or ordnance facility. 

The onset of lightning at a particular place can be predicted with considerable 
success while storms are still some distance away. These devices generally use 
field strength measurements plus counting and measuring of the electromagnetic 
fields resulting from lightning discharges. They can be of considerable assis- 
tance in planning operations on an hourly basis. 

4.0 CONCLUSIONS 

Static electricity and lightning have a significant probability of initiating 
squibs or detonators and damaging electronic equipment unless they are protected 
by safe-and-arm devices or by careful grounding plus other protective techniques. 
These are also quite dangerous with respect to initiating fires or explosions in 
the vapors and dusts which occur during many operations, such as handling liquid 
propellants and solvents. 

(This lecture was accompanied by a film which is highly recommended to the 
reader; "Static Electricity", obtainable from the American Gas Association, Inc., 
New York, New York.) 
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its height. A number of points which are vertically connected to the ground, 
and also horizontally connected near their points, will give a tent-like zone 
of protection. 

A steel frame building will give excellent protection, provided it is well 
grounded and has lightning rods installed. 

The above types of protection do not give complete protection from induced 
voltages and secondary arcs. The very high peak currents mentioned above are 
accompanied by intense electromagnetic fields which can induce significant 
voltages in nearby lines. In addition, a few ohms resistance to ground will, 

(by direct IR drop), permit large voltages to build up with possible arc-over 
to nearby conductors. 

When the need for secondary protection exists, double-layer protection can be 
of great help. A well-grounded, steel-frame buHding may be one layer. A 
separate lightning-rod system of aerial protect'on may be used for the other 
layer. Particularly sensitive devices might be screened by copper screening 
if very high protection from the electromagnetic field is desired. 

Pointed lightning rods do serve to reduce the electrical potential by early 
discharge, as well as act as a preferred path. 

Ungrounded objects such as tall trees are poor conductors and are thus not 
protectors, although they are sufficiently preferred paths to act as a focus 
for lightning discharge. When lightning strikes trees it may jump to a nearby 
object. It also tends to spread out about the base of the tree. If the 
ground is dry, a person or animal may be connected through his feet. Five 
hundred and three sheep were killed in this manner by a single lightning stroke 
jn some cases it would seem worthwhile to run a well grounded lightning rod up 
a tree, thus changing a hazard into a protective shelter. 

Much of this discussion has been about people. Wherever there is a hazard to 
people, there is a hazard to unprotected ordnance devices and electronic equip- 
ment. In fact, particularly with respect to induced voltages, th£ ordnance 
devices and electronic equipment may be considerably more sensitive than a 
pe rson . 


